View all vulnerabilities

CVE-2025-47944

Multer vulnerable to Denial of Service from maliciously crafted requests

Description

### Impact
A vulnerability in Multer versions >=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process.

‍
### Patches
Users should upgrade to `2.0.0`

### Workarounds
None

### References

- https://github.com/expressjs/multer/issues/1176
- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
7.5
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
multer >= 1.4.4-lts.1 < 2.0.0
Severity
High
High
High
Ecosystem
JavaScript
Publish Date
May 19, 2025
Modified Date
May 19, 2025