Packages / multer / Security

HighVulnerabilityGHSA-g5hg-p3ph-g8qgCVE-2025-48997Published 5 Jun 2025

Multer vulnerable to Denial of Service via unhandled exception

Your version

Affected releases · multer

  • 2.x2.0.0Fixed in 2.0.1
  • 1.x1.4.4No fix on this line yet

On 2.x, the newest line:

npm install multer@2.0.1
Every release on a timeline
2.x

  1. Affected

    2.0.0

    1 release

  2. Fixed

    2.0.1 – 2.5.0

    8 releases, latest

1.x

  1. Not affected

    1.0.0 – 1.4.3

    16 releases

  2. Affected

    1.4.4

    1 release

41 stable releases of multer, oldest to newest, one row per major.

What happens

Impact

A vulnerability in Multer versions >=1.4.4-lts.1, <2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.

Patches

Users should upgrade to 2.0.1

Workarounds

None

References

35a3272 #1233 #1256