What’s Vulnerable › Vulnerabilities

CVE-2025-7338: Multer vulnerable to Denial of Service via unhandled exception from malformed request

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-17 · updated 2026-06-17
• Weakness: CWE-248

Description

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.

Affected products

• multer: from 1.4.4-lts.1 before 2.0.2 — fixed in 2.0.2

How to fix

Upgrade to a fixed version: multer 2.0.2. Check the vendor advisory for mitigations.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b
• https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p

Get alerted when CVE-2025-7338 or the next vulnerability affects your stack