Uncaught Exception in multer - CVE-2025-47944

Vulnerability identifier: #VU111106

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-47944

CWE-ID: CWE-248

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send a malformed multi-part upload request and perform a denial of service (DoS) attack.

multer
watsonx Orchestrate Developer Edition
Security QRadar EDR
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
IBM OpenPages with Watson
Business Automation Insights
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
IBM Concert Software
Netcool Operations Insight
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Cloud Pak for Business Automation
watsonx.data
IBM App Connect Enterprise
IBM QRadar Data Synchronization App

Install updates from vendor's website.

multer - update to 2.0.0
IBM Concert Software - update to 2.0.0
watsonx Orchestrate Developer Edition - update to 1.13.0
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.1
Security QRadar EDR - update to 3.12.18
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.1
IBM OpenPages with Watson - addressed in versions 9.0.0.5, 9.1.1
IBM App Connect Enterprise - addressed in versions 12.0.12.15, 13.0.4.0
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM QRadar Data Synchronization App - update to 3.3.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF006, 24.0.1-IF004, 25.0.0-IF001

• https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
• https://github.com/expressjs/multer/issues/1176
• https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h

• Uncaught exception in expressjs multer
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM QRadar Data Synchronization App