Skip to main content

Uncaught Exception in multer

CVE-2025-48997

  • multer
  • org.webjars.npm:multer
High
8.7/10

Summary

Multer is a Node.js middleware for handling "multipart/form-data". A vulnerability allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. No known workarounds are available. This issue affects multer versions 1.4.4-lts.1 through 1.4.5-lts.2, and 2.0.0.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-248 - Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisory Timeline

  • Published