Uncaught Exception in multer - CVE-2025-48997

Vulnerability identifier: #VU113227

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2025-48997

CWE-ID: CWE-248

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
multer
watsonx Orchestrate Developer Edition
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Business Automation Insights
IBM Concert Software
Netcool Operations Insight
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Cloud Pak for Business Automation
IBM App Connect Enterprise
IBM QRadar Data Synchronization App

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to unhandled exception, leading to a crash of the process. A remote attacker can trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.

Install updates from vendor's website.

• https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9
• https://github.com/expressjs/multer/issues/1233
• https://github.com/expressjs/multer/pull/1256
• https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg