Vulnerability · Published May 19, 2025 · Assigned by GitHub_M
CVE-2025-47935Multer vulnerable to Denial of Service via memory leaks from unclosed streams
High 7.5
In plain English
A high-severity memory leak in multer from expressjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | multer | 2.0.0 | GHSA-44fp-w29j-9vj5 |
Affected products (as reported)
Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5 x_refsource_CONFIRM
- https://github.com/expressjs/multer/pull/1120 x_refsource_MISC
- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665 x_refsource_MISC