Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Published 19 May 2025 · Updated 10 Sept 2026
Affected package
- Affected
- <2.0.0
- Fixed in
- 2.0.0
npm install multer@2.0.0Details
Impact
Multer <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance.
This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted.
Patches
Users should upgrade to 2.0.0
Workarounds
None
References
- https://github.com/expressjs/multer/pull/1120
- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
Is GHSA-44fp-w29j-9vj5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected multer, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.