---
title: "GHSA-g5hg-p3ph-g8qg: Multer vulnerable to Denial of Service via unhandled exception"
description: "High severity. Multer vulnerable to Denial of Service via unhandled exception. Affects multer; fixed in 2.0.1."
url: https://inlinr.com/advisories/GHSA-g5hg-p3ph-g8qg
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-g5hg-p3ph-g8qg CVE-2025-48997 Published 5 Jun 2025

# Multer vulnerable to Denial of Service via unhandled exception

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 Fixed in 2.0.1
- 1.x 1.4.4 No fix on this line yet

On 2.x, the newest line:

```
npm install multer@2.0.1
```

Every release on a timeline

2.x 

1. Affected

2.0.0  
1 release
2. Fixed

2.0.1 – 2.5.0  
8 releases, latest

1.x 

1. Not affected

1.0.0 – 1.4.3  
16 releases
2. Affected

1.4.4  
1 release

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

A vulnerability in Multer versions >=1.4.4-lts.1, <2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.

Patches

Users should upgrade to `2.0.1`

Workarounds

None

References

[35a3272](https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9 "https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9") [#1233](https://github.com/expressjs/multer/issues/1233 "https://github.com/expressjs/multer/issues/1233") [#1256](https://github.com/expressjs/multer/pull/1256 "https://github.com/expressjs/multer/pull/1256")

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:4.0/​AV:N/​AC:L/​AT:N/​PR:N/​UI:N/​VC:N/​VI:N/​VA:H/​SC:N/​SI:N/​SA:N

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg "https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-48997 "https://nvd.nist.gov/vuln/detail/CVE-2025-48997")  
nvd.nist.gov/vuln/detail/CVE-2025-48997
- [Issue](https://github.com/expressjs/multer/issues/1233 "https://github.com/expressjs/multer/issues/1233")  
#1233
- [Pull request](https://github.com/expressjs/multer/pull/1256 "https://github.com/expressjs/multer/pull/1256")  
#1256
- [Fix commit](https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9 "https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9")  
35a3272
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer