CVE-2025-47935
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
- Record
CVE-2025-47935- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
EUVDEUVD-2025-15797
Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
- Record
EUVD-2025-15797- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-44fp-w29j-9vj5
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Impact
Multer <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance.
This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted.
Patches
Users should upgrade to 2.0.0
Workarounds
None
References
- Record
GHSA-44fp-w29j-9vj5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
NVD
Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
- Record
CVE-2025-47935- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSV
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
- Record
CVE-2025-47935- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVGHSA-44fp-w29j-9vj5
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Impact
Multer <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance.
This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted.
Patches
Users should upgrade to 2.0.0
Workarounds
None
References
- Record
GHSA-44fp-w29j-9vj5- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVCLSA-2026-1773879509 No score
TuxCare security update for multer (3 CVEs)
TuxCare rebuilt multer to address 3 CVEs. Fixed in 1.4.5-lts.1-tuxcare.1.
- Record
CLSA-2026-1773879509- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-47935 No score
CVE-2025-47935 in multer - Patched by Root
Root has patched CVE-2025-47935 in the multer package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-47935- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
multernpm |
before 2.0.0 | 2.0.0 |
multerTuxCare:npm From an advisory covering 3 CVEs |
1.4.5-lts.1-tuxcare.0 up to 1.4.5-lts.1-tuxcare.1, plus listed versions 1.4.5-lts.1 |
1.4.5-lts.1-tuxcare.1 |
multerRoot:npm |
before 1.4.4-lts.1-aikido.3 | 1.4.4-lts.1-aikido.31.4.5-lts.2-aikido.91.4.5-lts.2-aikido.51.4.4-lts.1-aikido.41.4.4-aikido.21.4.2-aikido.11.4.5-lts.1-aikido.21.4.5-lts.1-aikido.31.4.4-aikido.31.4.4-lts.1-aikido.11.4.4-aikido.41.4.5-lts.1-aikido.11.4.4-lts.1-aikido.21.4.4-aikido.51.4.5-lts.2-aikido.61.4.4-aikido.61.4.2-aikido.21.4.5-lts.2-aikido.71.4.5-lts.2-aikido.8 |
@rootio/multerRoot:npm |
before 1.4.4-lts.1-root.io.3 | 1.4.4-lts.1-root.io.31.4.5-lts.2-root.io.21.4.5-lts.2-root.io.31.4.5-lts.2-root.io.41.4.5-lts.2-root.io.91.4.5-lts.2-root.io.51.4.4-lts.1-root.io.41.4.4-root.io.21.4.4-root.io.11.4.2-root.io.11.4.5-lts.1-root.io.21.4.5-lts.1-root.io.31.4.4-root.io.31.4.4-lts.1-root.io.11.4.4-root.io.41.4.5-lts.1-root.io.11.4.4-lts.1-root.io.21.4.4-root.io.51.4.5-lts.2-root.io.61.4.4-root.io.61.4.2-root.io.21.4.5-lts.2-root.io.71.4.5-lts.2-root.io.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-47935 is a high vulnerability (CVSS 7.5) in Expressjs Multer, published May 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in multer 2.0.0.
References
github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5
nvd.nist.gov/vuln/detail/CVE-2025-47935