OpenJS Foundation multer: Unauthenticated process crash via async fileFilter (CVE-2026-113872)

A denial-of-service vulnerability exists in the multer middleware for Node.js (CVE-2026-113872). The vulnerability occurs when multer is configured with an asynchronous fileFilter and processes requests containing multiple files. If an earlier part of the multipart request triggers an error, the request teardown removes event listeners from the underlying busboy parser. If a subsequent asynchronous fileFilter completes after the teardown, it forces the parser to resume processing a truncated or malformed body. This triggers an error on the busboy instance that no longer has an error listener, resulting in an uncaught exception that terminates the Node.js process.

Attack Chain

1. Attacker identifies an Express application using multer (>= 2.0.0, <= 2.4.0) with an asynchronous fileFilter.
2. Attacker initiates a multipart/form-data request containing at least two file parts.
3. Attacker triggers a failure on the first file part (e.g., via the fileFilter logic) to initiate the request teardown process.
4. The application performs teardown, calling busboy.removeAllListeners().
5. The attacker's second, pending fileFilter completes after the teardown occurs.
6. The fileStream.resume() call triggers the busboy parser to process the buffered input.
7. The parser encounters an error (e.g., unexpected end of form) and emits it on the busboy instance.
8. Due to the removed listeners, the error becomes an uncaught exception, crashing the Node.js process.

Impact

The vulnerability allows an unauthenticated remote attacker to cause a complete service disruption by crashing the target Node.js process with a single crafted HTTP request.

Recommendation

• Upgrade multer to version 2.5.0 or later immediately.
• If upgrading is not immediately possible, refactor the fileFilter to be synchronous and move any asynchronous validation logic into the route handler following the multer middleware.