{"id":"CVE-2025-47944","aliases":["CLSA-2026-1773879509","EUVD-2025-15796","GHSA-4pg4-qvpc-4q3h","ROOT-APP-NPM-CVE-2025-47944"],"status":"published","title":"Multer vulnerable to Denial of Service from maliciously crafted requests","description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00811,"percentile":0.57381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2025-05-19T19:20:45Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"npm","package":"multer","fixed_in":["2.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"multer","fixed_in":["1.4.4-lts.1-aikido.3","1.4.5-lts.2-aikido.9","1.4.5-lts.2-aikido.5","1.4.4-lts.1-aikido.4","1.4.4-aikido.2","1.4.5-lts.1-aikido.2","1.4.5-lts.1-aikido.3","1.4.4-aikido.3","1.4.4-lts.1-aikido.1","1.4.4-aikido.4","1.4.5-lts.1-aikido.1","1.4.4-lts.1-aikido.2","1.4.4-aikido.5","1.4.5-lts.2-aikido.6","1.4.4-aikido.6","1.4.5-lts.2-aikido.7","1.4.5-lts.2-aikido.8"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/multer","fixed_in":["1.4.4-lts.1-root.io.3","1.4.5-lts.2-root.io.3","1.4.5-lts.2-root.io.4","1.4.5-lts.2-root.io.9","1.4.5-lts.2-root.io.5","1.4.4-lts.1-root.io.4","1.4.4-root.io.2","1.4.4-root.io.1","1.4.5-lts.1-root.io.2","1.4.5-lts.1-root.io.3","1.4.4-root.io.3","1.4.4-lts.1-root.io.1","1.4.4-root.io.4","1.4.5-lts.1-root.io.1","1.4.4-lts.1-root.io.2","1.4.4-root.io.5","1.4.5-lts.2-root.io.6","1.4.4-root.io.6","1.4.5-lts.2-root.io.7","1.4.5-lts.2-root.io.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.4-lts.1"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.5-lts.1-tuxcare.0"},{"fixed":"1.4.5-lts.1-tuxcare.1"}]}],"versions":["1.4.5-lts.1"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"multer","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.4-lts.1"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-lts.1-aikido.3"},{"fixed":"1.4.5-lts.2-aikido.9"},{"fixed":"1.4.5-lts.2-aikido.5"},{"fixed":"1.4.4-lts.1-aikido.4"},{"fixed":"1.4.4-aikido.2"},{"fixed":"1.4.5-lts.1-aikido.2"},{"fixed":"1.4.5-lts.1-aikido.3"},{"fixed":"1.4.4-aikido.3"},{"fixed":"1.4.4-lts.1-aikido.1"},{"fixed":"1.4.4-aikido.4"},{"fixed":"1.4.5-lts.1-aikido.1"},{"fixed":"1.4.4-lts.1-aikido.2"},{"fixed":"1.4.4-aikido.5"},{"fixed":"1.4.5-lts.2-aikido.6"},{"fixed":"1.4.4-aikido.6"},{"fixed":"1.4.5-lts.2-aikido.7"},{"fixed":"1.4.5-lts.2-aikido.8"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-lts.1-root.io.3"},{"fixed":"1.4.5-lts.2-root.io.3"},{"fixed":"1.4.5-lts.2-root.io.4"},{"fixed":"1.4.5-lts.2-root.io.9"},{"fixed":"1.4.5-lts.2-root.io.5"},{"fixed":"1.4.4-lts.1-root.io.4"},{"fixed":"1.4.4-root.io.2"},{"fixed":"1.4.4-root.io.1"},{"fixed":"1.4.5-lts.1-root.io.2"},{"fixed":"1.4.5-lts.1-root.io.3"},{"fixed":"1.4.4-root.io.3"},{"fixed":"1.4.4-lts.1-root.io.1"},{"fixed":"1.4.4-root.io.4"},{"fixed":"1.4.5-lts.1-root.io.1"},{"fixed":"1.4.4-lts.1-root.io.2"},{"fixed":"1.4.4-root.io.5"},{"fixed":"1.4.5-lts.2-root.io.6"},{"fixed":"1.4.4-root.io.6"},{"fixed":"1.4.5-lts.2-root.io.7"},{"fixed":"1.4.5-lts.2-root.io.8"}]}]}],"products":[{"vendor":"expressjs","product":"multer"}],"references":[{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/expressjs/multer/issues/1176","tags":["x_refsource_MISC","report","web"]},{"url":"https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47944","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4pg4-qvpc-4q3h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47944.json","tags":["advisory"]},{"url":"https://github.com/expressjs/multer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-47944","title":"Multer vulnerable to Denial of Service from maliciously crafted requests","description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","status":"published","published":"2025-05-19T19:20:45.401Z","modified":"2025-05-20T13:13:49.579Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:32:25.982948Z"}],"euvd":[{"id":"EUVD-2025-15796","description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","status":"published","published":"2025-05-19T19:20:45Z","modified":"2025-05-20T13:13:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:43.763029Z"}],"ghsa":[{"id":"GHSA-4pg4-qvpc-4q3h","title":"Multer vulnerable to Denial of Service from maliciously crafted requests","description":"### Impact\nA vulnerability in Multer versions \u003e=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process.\n\n### Patches\nUsers should upgrade to `2.0.0`\n\n### Workarounds\nNone\n\n### References\n\n- https://github.com/expressjs/multer/issues/1176\n- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","status":"published","published":"2025-05-19T22:16:30Z","modified":"2025-05-21T20:37:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:38:43.998596Z"}],"nvd":[{"id":"CVE-2025-47944","description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","status":"published","published":"2025-05-19T20:15:26.007Z","modified":"2026-06-17T09:28:52.68Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:11:09.125937Z"}],"osv":[{"id":"CVE-2025-47944","title":"Multer vulnerable to Denial of Service from maliciously crafted requests","description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","status":"published","published":"2025-05-19T19:20:45.401Z","modified":"2026-10-28T02:30:26.988090394Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-4pg4-qvpc-4q3h","title":"Multer vulnerable to Denial of Service from maliciously crafted requests","description":"### Impact\nA vulnerability in Multer versions \u003e=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process.\n\n### Patches\nUsers should upgrade to `2.0.0`\n\n### Workarounds\nNone\n\n### References\n\n- https://github.com/expressjs/multer/issues/1176\n- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","status":"published","published":"2025-05-19T22:16:30Z","modified":"2026-09-10T03:50:24.279436659Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"CLSA-2026-1773879509","title":"TuxCare security update for multer (3 CVEs)","description":"TuxCare rebuilt multer to address 3 CVEs. Fixed in 1.4.5-lts.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.30524478Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"ROOT-APP-NPM-CVE-2025-47944","title":"CVE-2025-47944 in multer - Patched by Root","description":"Root has patched CVE-2025-47944 in the multer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-15T18:19:46Z","modified":"2026-09-15T19:15:04.183092443Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}