SB2026102501 - Uncaught Exception in multer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102501

SB2026102501 - Uncaught Exception in multer

Published: October 25, 2026

Security Bulletin ID SB2026102501
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Uncaught Exception (CVE-ID: CVE-2026-113872)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing the Node.js process.

The vulnerability exists due to an uncaught exception in multer's asynchronous fileFilter handling when a pending callback resumes a parsing stream after request teardown. A remote attacker can send a specially crafted upload request that is aborted while another file's asynchronous fileFilter is pending to trigger an unhandled error event from busboy and terminate the process.


Remediation

Install update from vendor's website.

References