CVE-2025-47944: Multer Node.js Middleware DoS Vulnerability

CVE-2025-47944 Overview

CVE-2025-47944 is a Denial of Service (DoS) vulnerability in Multer, a popular Node.js middleware used for handling multipart/form-data requests, commonly employed for file uploads in Express.js applications. The vulnerability allows an attacker to crash the Node.js process by sending a specially crafted malformed multipart upload request, causing an unhandled exception that terminates the application.

Critical Impact

Attackers can exploit this vulnerability remotely without authentication to crash Node.js applications using vulnerable versions of Multer, causing service disruption for all users.

Affected Products

• Multer versions 1.4.4-lts.1 and later (prior to 2.0.0)
• Node.js applications using affected Multer versions for file upload handling
• Express.js applications with multipart/form-data endpoints

Discovery Timeline

• May 19, 2025 - CVE-2025-47944 published to NVD
• May 21, 2025 - Last updated in NVD database

Technical Details for CVE-2025-47944

Vulnerability Analysis

This vulnerability is classified under CWE-248 (Uncaught Exception), indicating that the Multer middleware fails to properly handle certain malformed input during multipart form data processing. When a maliciously crafted multipart upload request is received, the middleware encounters an unexpected condition that triggers an exception. Because this exception is not caught and handled appropriately, it propagates up the call stack and causes the entire Node.js process to crash.

The network-accessible nature of this vulnerability means any attacker who can send HTTP requests to an affected endpoint can exploit it without requiring any authentication or special privileges. The impact is limited to availability—there is no confidentiality or integrity breach—but the ability to crash production services makes this a significant concern for applications relying on Multer for file uploads.

Root Cause

The root cause of CVE-2025-47944 lies in insufficient input validation and error handling within Multer's multipart form data parser. When processing the boundaries and headers of multipart requests, the code fails to account for certain malformed input patterns, leading to an unhandled exception. The lack of proper try-catch blocks or error handlers around the vulnerable code path allows the exception to crash the Node.js event loop.

Attack Vector

The attack vector for this vulnerability is network-based and requires no user interaction or special privileges. An attacker can exploit this vulnerability by:

1. Identifying an endpoint that accepts multipart/form-data requests (typically file upload functionality)
2. Crafting a malformed multipart request with specific boundary or header anomalies
3. Sending the malicious request to the target endpoint
4. The unhandled exception crashes the Node.js process, causing a denial of service

The vulnerability does not require the attacker to upload a complete file or have valid credentials. Simply sending the malformed request structure is sufficient to trigger the crash.

For technical details on the vulnerability and the specific fix, see the GitHub Security Advisory and the commit that patches the issue.

Detection Methods for CVE-2025-47944

Indicators of Compromise

• Sudden, unexplained crashes of Node.js processes handling file uploads
• Error logs showing uncaught exceptions originating from Multer middleware
• Spike in failed or incomplete multipart upload requests before process termination
• Application restarts coinciding with suspicious HTTP POST requests to upload endpoints

Detection Strategies

• Monitor Node.js process stability and implement alerting on unexpected crashes
• Review application logs for unhandled exception errors related to multipart parsing
• Implement request logging to capture details of HTTP requests preceding crashes
• Use application performance monitoring (APM) tools to detect crash patterns
• Audit package.json and package-lock.json for vulnerable Multer versions (>=1.4.4-lts.1 and <2.0.0)

Monitoring Recommendations

• Enable verbose logging on file upload endpoints to capture request metadata
• Set up automated dependency scanning to identify vulnerable Multer versions
• Configure process managers (PM2, systemd) to alert on repeated restarts
• Monitor network traffic patterns for unusual multipart request structures

How to Mitigate CVE-2025-47944

Immediate Actions Required

• Upgrade Multer to version 2.0.0 or later immediately
• Audit all Node.js applications to identify those using vulnerable Multer versions
• If immediate upgrade is not possible, consider temporarily disabling file upload functionality
• Implement rate limiting on upload endpoints to reduce exposure
• Deploy web application firewalls (WAF) with rules to filter malformed multipart requests

Patch Information

The Multer development team has addressed this vulnerability in version 2.0.0. Users should upgrade to this version to receive the fix. The patch is available in commit 2c8505f.

To update Multer, run:

npm install multer@2.0.0

Or update your package.json to specify the fixed version and run npm install.

Workarounds

• No official workarounds are available according to the security advisory
• As a temporary measure, consider adding a reverse proxy layer to filter requests
• Implement process monitoring with automatic restart capabilities to minimize downtime
• Consider using alternative file upload middleware temporarily while planning the upgrade

# Verify your current Multer version
npm list multer

# Update to the patched version
npm update multer --save

# Verify the update was successful
npm list multer