multer: DoS process crash via pending async fileFilter after request teardown (CVE-2026-113872)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-113872
A high-severity denial-of-service vulnerability (CVE-2026-113872, GHSA-q7qp-rjg7-q26m) in multer 2.0.0–2.4.x lets a single unauthenticated request crash the Node.js process. When an asynchronous fileFilter is configured, aborting a request (e.g. one file rejected) while another file's async fileFilter is pending causes the callback to resume a parsing stream multer has already torn down; busboy then emits an error on a stream with no error listener, triggering an unhandled 'error' event and process exit. Any app using multer with an async fileFilter is affected regardless of storage engine; sync fileFilter usage is unaffected. Fixed in multer 2.5.0 (released Oct 22, 2026); workaround is using a synchronous fileFilter. No in-the-wild exploitation reported.
What to do
- Upgrade multer to 2.5.0 or later and redeploy
- If upgrading is not immediately possible, switch to a synchronous fileFilter or remove async fileFilter usage
- Add process-level monitoring/restarts (e.g. PM2, Kubernetes liveness probes) to limit DoS impact
- Review upload endpoints for exposure to unauthenticated multipart requests
Fixed versions
Sources
All live incidents on Threat Watch
