HighGHSA-g5hg-p3ph-g8qgCVE-2025-48997

Multer vulnerable to Denial of Service via unhandled exception

Published 5 Jun 2025 · Updated 10 Sept 2026

Affected package

Affected: >=1.4.4-lts.1 <2.0.1
Fixed in: 2.0.1

Update to the fixed version for your release line, for example:npm install multer@2.0.1

Details

Impact

A vulnerability in Multer versions >=1.4.4-lts.1, <2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.

Patches

Users should upgrade to 2.0.1

Workarounds

None

References

https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9 https://github.com/expressjs/multer/issues/1233 https://github.com/expressjs/multer/pull/1256

Is GHSA-g5hg-p3ph-g8qg in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected multer, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.