Zero Radar
← feed
HighVulnerabilityCVE-2026-113872updated 25 Oct 2026, 13:32 UTC

Multer upload library can crash Node.js server with one request

A single uploaded request can make a Node.js app using multer shut down completely. Apps that only use simple, non-delayed file checks are not affected.

Fixed in multer 2.5.0 or laterOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesmulter 2.5.0 or later · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends uploadMultipart request with several files
  2. 2Request is abortedOne file is rejected mid-upload
  3. 3Pending filter resumesAsync callback reads a closed stream
  4. 4Unhandled error eventStream has no error listener left
  5. ResultNode.js process crashes and exits

What happened

In multer 2.0.0 before 2.5.0, using an asynchronous fileFilter lets an aborted request leave a parsing stream without an error listener, causing an unhandled 'error' event that exits the Node.js process.

Why it is dangerous: Anyone who can reach an upload endpoint can take the whole application offline with one request, with no login needed. Any storage engine is affected.

Are you affected?

You are affected if your Node.js app uses multer 2.0.0 up to (not including) 2.5.0 and configures an asynchronous fileFilter.

Package / productAffected versionsFixed in
multer · npm>= 2.0.0, < 2.5.02.5.0

What to do

  1. Update multer to 2.5.0 or later (npm install multer@latest)
  2. Redeploy and restart the application after updating
  3. If you cannot update now, switch to a synchronous fileFilter as a temporary workaround

Timeline

  1. 22 Oct 2026, 15:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 15:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 22:08 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-113872 · GHSA-q7qp-rjg7-q26m
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 15:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Multer upload library can crash Node.js server with one request · Zero Radar