{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopenjsfmulter2.0.0node.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openjsf:multer:2.0.0:*:*:*:*:node.js:*:*","cpe:2.3:a:openjsf:multer:2.1.0:*:*:*:*:node.js:*:*","cpe:2.3:a:openjsf:multer:2.2.0:*:*:*:*:node.js:*:*","cpe:2.3:a:openjsf:multer:2.3.0:*:*:*:*:node.js:*:*","cpe:2.3:a:openjsf:multer:2.4.0:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-113872"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["multer (2.0.0 to 2.4.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenJS Foundation"],"content_html":"\u003cp\u003eA denial-of-service vulnerability exists in the multer middleware for Node.js (CVE-2026-113872). The vulnerability occurs when multer is configured with an asynchronous \u003ccode\u003efileFilter\u003c/code\u003e and processes requests containing multiple files. If an earlier part of the multipart request triggers an error, the request teardown removes event listeners from the underlying busboy parser. If a subsequent asynchronous \u003ccode\u003efileFilter\u003c/code\u003e completes after the teardown, it forces the parser to resume processing a truncated or malformed body. This triggers an error on the busboy instance that no longer has an error listener, resulting in an uncaught exception that terminates the Node.js process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an Express application using \u003ccode\u003emulter\u003c/code\u003e (\u0026gt;= 2.0.0, \u0026lt;= 2.4.0) with an asynchronous \u003ccode\u003efileFilter\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a multipart/form-data request containing at least two file parts.\u003c/li\u003e\n\u003cli\u003eAttacker triggers a failure on the first file part (e.g., via the \u003ccode\u003efileFilter\u003c/code\u003e logic) to initiate the request teardown process.\u003c/li\u003e\n\u003cli\u003eThe application performs teardown, calling \u003ccode\u003ebusboy.removeAllListeners()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker's second, pending \u003ccode\u003efileFilter\u003c/code\u003e completes after the teardown occurs.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efileStream.resume()\u003c/code\u003e call triggers the busboy parser to process the buffered input.\u003c/li\u003e\n\u003cli\u003eThe parser encounters an error (e.g., unexpected end of form) and emits it on the busboy instance.\u003c/li\u003e\n\u003cli\u003eDue to the removed listeners, the error becomes an uncaught exception, crashing the Node.js process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated remote attacker to cause a complete service disruption by crashing the target Node.js process with a single crafted HTTP request.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003emulter\u003c/code\u003e to version \u003ccode\u003e2.5.0\u003c/code\u003e or later immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, refactor the \u003ccode\u003efileFilter\u003c/code\u003e to be synchronous and move any asynchronous validation logic into the route handler following the multer middleware.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T04:18:39Z","date_published":"2026-10-23T04:18:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-multer-denial-of-service/","summary":"An unauthenticated attacker can crash Node.js applications using multer versions 2.0.0 through 2.4.0 by sending crafted multipart requests that trigger uncaught exceptions in the busboy parser after request teardown.","title":"OpenJS Foundation multer: Unauthenticated process crash via async fileFilter (CVE-2026-113872)","url":"https://feed.craftedsignal.io/briefs/2026-10-multer-denial-of-service/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:openjsf:multer:2.0.0:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}