---
title: "GHSA-q7qp-rjg7-q26m: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown"
description: "High severity. multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown. Affects multer; fixed in 2.5.0."
url: https://inlinr.com/advisories/GHSA-q7qp-rjg7-q26m
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-q7qp-rjg7-q26m CVE-2026-113872 Published 23 Oct 2026

# multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.4.0 Fixed in 2.5.0

On 2.x, the newest line:

```
npm install multer@2.5.0
```

Every release on a timeline

1. Not affected

0.0.1 – 1.4.4  
32 releases
2. Affected

2.0.0 – 2.4.0  
8 releases
3. Fixed

2.5.0  
1 release, latest

41 stable releases of multer, oldest to newest.

## What happens

Impact

When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async `fileFilter` is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled `'error'` event, and the process exits. A single unauthenticated request is enough, so any application using `multer` with an asynchronous `fileFilter` is affected, regardless of storage engine. Uploads using a synchronous `fileFilter` are not affected.

Patches

Users should upgrade to `multer` `2.5.0` or later.

Workarounds

Use a synchronous `fileFilter`.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m "https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-113872 "https://nvd.nist.gov/vuln/detail/CVE-2026-113872")  
nvd.nist.gov/vuln/detail/CVE-2026-113872
- [Fix commit](https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf "https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf")  
80a2d9d
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer
- [Reference](https://github.com/expressjs/multer/releases/tag/v2.5.0 "https://github.com/expressjs/multer/releases/tag/v2.5.0")  
github.com/expressjs/multer/releases/tag/v2.5.0