Multer DoS Vulnerability (CVE-2025-7338): How a Single Malformed Upload Can Crash Your Node.js App

A single malformed upload request can take down an entire Node.js application, and the attacker needs no authentication to send it. That is the real-world impact of CVE-2025-7338, a high-severity Denial of Service (DoS) flaw in Multer, the most widely used file upload middleware for Express.js. Multer has over 26 million monthly downloads and is a core dependency for web and enterprise apps across the Node.js ecosystem, so a flaw like this one has a very large potential for disruption.

Technical Information

CVE-2025-7338 comes from the way Multer handles multipart/form-data, the encoding used for file uploads. It affects Multer versions from 1.4.4-lts.1 up to, but not including, 2.0.2.

Vulnerability Mechanism:

Multer uses the Busboy parser to process incoming multipart requests. When a request contains malformed data, such as an empty field name or an improperly terminated boundary, Busboy emits an error event. Before version 2.0.2, Multer did not handle these errors properly. The error bubbles up as an uncaught exception and terminates the Node.js process immediately.

Attack Vector:

An attacker can exploit this with a single HTTP POST request carrying a crafted payload, such as this one:

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
Content-Length: 145

------WebKitFormBoundary
Content-Disposition: form-data; name=""; filename="exploit.txt"
Content-Type: text/plain

[Malicious payload]
------WebKitFormBoundary--

The empty name attribute makes Busboy emit an error. Multer does not catch it, so the process crashes. The attacker needs no authentication or special privileges. Anyone with network access can exploit the flaw.

Root Cause:

Multer has no handler for Busboy's error events. When Busboy hits malformed input, it emits an error, and with nothing to handle it, Node.js treats the error as a fatal exception and terminates the process.

Affected Middleware Methods:

All Multer middleware methods are affected:

• single()
• array()
• fields()

Any Express.js or similar application that uses these methods with a vulnerable Multer version is at risk.

Patch Information

Multer's development team released version 2.0.2 to fix the Denial of Service (DoS) vulnerability in versions >=1.4.4-lts.1 and <2.0.2. In the affected versions, attackers could crash the application with malformed requests that triggered unhandled exceptions.

The patch adds error handling for exceptions caused by malformed requests. With these handlers in place, the application deals with the error instead of terminating unexpectedly.

Users are strongly advised to upgrade to Multer version 2.0.2 to mitigate this vulnerability. The update manages these exceptions, so the application can withstand this kind of DoS attack.

Patch source: Multer Security Advisory (GHSA-fjgf-rc76-4x9p)

Affected Systems and Versions

• Product: Multer (Node.js middleware for handling multipart/form-data)
• Affected Versions: All versions from 1.4.4-lts.1 up to, but not including, 2.0.2
• Vulnerable Configurations: Any application using Multer for file uploads with these versions, regardless of configuration. All middleware methods (single, array, fields) are affected.

Vendor Security History

Multer is maintained by the Express.js team and is the de facto standard for file uploads in Node.js. The team has a strong record of responding quickly to security issues. In 2025 it patched three critical vulnerabilities, including CVE-2025-7338, within weeks of disclosure. Earlier vulnerabilities such as CVE-2025-47944 and CVE-2025-47935 were also fixed promptly. That record points to a mature and responsive security posture.

References

• NVD Entry for CVE-2025-7338
• Official CVE Entry
• Multer Security Advisory (GHSA-fjgf-rc76-4x9p)
• Multer Patch Commit
• OpenJS Foundation Security Advisories

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]