Uncaught Exception in multer - CVE-2025-48997

Vulnerability identifier: #VU113227

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-48997

CWE-ID: CWE-248

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to unhandled exception, leading to a crash of the process. A remote attacker can trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.

multer
watsonx Orchestrate Developer Edition
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Business Automation Insights
IBM Concert Software
Netcool Operations Insight
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Cloud Pak for Business Automation
IBM App Connect Enterprise
IBM QRadar Data Synchronization App

Install updates from vendor's website.

multer - update to 2.0.1
IBM Concert Software - update to 2.0.0
watsonx Orchestrate Developer Edition - update to 1.13.0
Netcool Operations Insight - update to 1.6.15
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.1
IBM Spectrum Control - update to 5.4.13.2
IBM App Connect Enterprise - addressed in versions 12.0.12.16, 13.0.4.0
IBM QRadar Data Synchronization App - update to 3.3.0
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF006, 24.0.1-IF005, 25.0.0-IF001
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.5, 25.0.0.0.1

• https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9
• https://github.com/expressjs/multer/issues/1233
• https://github.com/expressjs/multer/pull/1256
• https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg

• Uncaught exception in Multer
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Concert Software
• IBM Watson Discovery Cartridge update for Multer
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Multer
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM watsonx Orchestrate Developer Edition update for Multer
• Multiple vulnerabilities in Netcool Operations Insight
• IBM Spectrum Control update for Multer
• Multiple vulnerabilities in IBM QRadar Data Synchronization App