CVE-2025-48997: Multer Middleware DoS Vulnerability

CVE-2025-48997 Overview

CVE-2025-48997 is a Denial of Service (DoS) vulnerability in Multer, a popular Node.js middleware used for handling multipart/form-data in file upload operations. The vulnerability allows an attacker to crash the application process by sending a specially crafted upload request with an empty string field name. When the middleware encounters this malformed input, it triggers an unhandled exception (CWE-248: Uncaught Exception), causing the entire Node.js process to terminate unexpectedly.

Critical Impact

Applications using vulnerable versions of Multer can be crashed remotely by any unauthenticated attacker who can send multipart form data requests, potentially causing significant service disruption.

Affected Products

• Multer versions 1.4.4-lts.1 through 2.0.0
• Node.js applications using vulnerable Multer middleware
• Express.js applications with multipart form handling via Multer

Discovery Timeline

• June 3, 2025 - CVE-2025-48997 published to NVD
• June 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-48997

Vulnerability Analysis

This vulnerability stems from improper input validation in the Multer middleware when processing multipart form data. When a file upload request contains a field with an empty string as its name, the middleware fails to handle this edge case gracefully. Instead of returning an error or rejecting the malformed input, the code path leads to an uncaught exception that propagates through the Node.js event loop.

The vulnerability is classified as CWE-248 (Uncaught Exception), indicating that the application does not properly catch or handle exceptional conditions during execution. In Node.js applications, uncaught exceptions that are not handled by process-level error handlers will terminate the entire process, making this particularly dangerous for production services.

Root Cause

The root cause is insufficient input validation in the field name parsing logic. The Multer middleware does not properly validate or sanitize the field name parameter before processing it. When an empty string is provided as a field name in a multipart form upload, the code attempts to process this value in a way that triggers an exception. The absence of a try-catch block or proper validation around this code path allows the exception to remain uncaught, ultimately crashing the Node.js process.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a malformed HTTP POST request with multipart/form-data content type to any endpoint that uses the vulnerable Multer middleware for file uploads.

The exploitation process involves:

1. Identifying an application endpoint that accepts file uploads via Multer
2. Crafting a multipart form data request with a file field that has an empty string as its name
3. Sending the malicious request to the target server
4. The server process crashes upon processing the request

Since no authentication is required and the attack can be performed remotely over the network, this vulnerability poses a significant risk to the availability of affected applications. Repeated exploitation could be used to keep a service offline indefinitely.

Detection Methods for CVE-2025-48997

Indicators of Compromise

• Unexpected Node.js process terminations or crashes in applications handling file uploads
• Error logs showing uncaught exceptions originating from Multer middleware
• Malformed multipart form requests with empty field names in access logs
• Sudden service unavailability following file upload attempts

Detection Strategies

• Monitor application logs for uncaught exception errors related to multipart form processing
• Implement request logging and inspect multipart form data for empty field names
• Use application performance monitoring (APM) tools to detect unexpected process restarts
• Deploy web application firewall (WAF) rules to identify and block malformed multipart requests

Monitoring Recommendations

• Enable verbose logging on file upload endpoints to capture field metadata
• Configure alerting for Node.js process crashes or unexpected restarts
• Monitor request patterns for potential DoS attack indicators such as repeated malformed uploads
• Implement health check endpoints to detect service availability issues quickly

How to Mitigate CVE-2025-48997

Immediate Actions Required

• Upgrade Multer to version 2.0.1 or later immediately
• Review application dependencies using npm audit or similar tools to identify vulnerable versions
• Implement process-level exception handlers as a temporary safeguard
• Consider deploying rate limiting on file upload endpoints to reduce DoS impact

Patch Information

The vulnerability has been patched in Multer version 2.0.1. Users should update their dependency by running npm update multer or modifying their package.json to require version 2.0.1 or higher. The fix addresses the uncaught exception by properly validating field names before processing.

For detailed information about the patch, refer to the GitHub Security Advisory, the GitHub Commit, and the related Pull Request.

Workarounds

• No official workarounds are available according to the security advisory
• As a temporary measure, implement a custom middleware to validate field names before Multer processing
• Consider using process managers like PM2 to automatically restart crashed processes
• Deploy load balancers with health checks to route traffic away from crashed instances

# Upgrade Multer to patched version
npm update multer@2.0.1

# Verify installed version
npm list multer

# Run security audit to check for other vulnerabilities
npm audit