Memory leak in multer - CVE-2025-47935

Vulnerability identifier: #VU111105

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-47935

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. A remote attacker can force the application to leak memory and perform denial of service attack.

multer
watsonx Orchestrate Developer Edition
Security QRadar EDR
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
IBM OpenPages with Watson
Business Automation Insights
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
IBM Concert Software
Netcool Operations Insight
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Cloud Pak for Business Automation
watsonx.data
IBM App Connect Enterprise
IBM QRadar Data Synchronization App

Install updates from vendor's website.

multer - update to 2.0.0
IBM Concert Software - update to 2.0.0
watsonx Orchestrate Developer Edition - update to 1.13.0
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.1
Security QRadar EDR - update to 3.12.18
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.1
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.29, 8.7.23, 9.1.2
IBM OpenPages with Watson - addressed in versions 9.0.0.5, 9.1.1
IBM App Connect Enterprise - addressed in versions 12.0.12.15, 13.0.4.0
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM QRadar Data Synchronization App - update to 3.3.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF006, 24.0.1-IF004, 25.0.0-IF001

• https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
• https://github.com/expressjs/multer/pull/1120
• https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5

• Memory leak in expressjs multer
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition
• IBM Maximo Application Suite - Manage Component update for multer
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM QRadar Data Synchronization App