CVE-2026-113872High· 7.5▾ MidnightPoC availablemulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
1 GitHub repo
0.4%
0.4% → 0.4%
When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is enough, so any application using multer with an asynchronous fileFilter is affected, regardless of storage engine. Uploads using a synchronous fileFilter are not affected.
Users should upgrade to multer 2.5.0 or later.
Use a synchronous fileFilter.
multer >= 2.0.0, < 2.5.0Upgrade to a patched release:
multer 2.5.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111181High· 7.5body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-109869High· 7.5undici is an HTTP client library for Node.js
CVE-2026-109855High· 7.5undici is an HTTP client library for Node.js
CVE-2026-105922Medium· 4.3A security flaw has been discovered in vllm-project vLLM up to 0.31.0
CVE-2026-92081Medium· 5.9fastify is a fast and low-overhead web framework for Node.js
CVE-2026-77078High· 7.5multer: Multer: Denial of Service via crafted multipart field names (CVE-2026-77078)