Uncaught Exception in multer - CVE-2026-113872
Published: October 25, 2026
Vulnerability identifier: #VU157642
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-113872
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing the Node.js process.
The vulnerability exists due to an uncaught exception in multer's asynchronous fileFilter handling when a pending callback resumes a parsing stream after request teardown. A remote attacker can send a specially crafted upload request that is aborted while another file's asynchronous fileFilter is pending to trigger an unhandled error event from busboy and terminate the process.
Affected software
multer
How to mitigate CVE-2026-113872
Install security update from vendor's website.
multer - update to 2.5.0