CVE-2026-113872 in multer
Summary
by MITRE • 10/23/2026
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the multer middleware for Node.js represents a critical reliability flaw within version ranges spanning from 2.0.0 up to but not including 2.5.0. Multer serves as an essential component for handling multipart/form-data requests, facilitating file uploads by parsing incoming form data and managing temporary storage of files during processing. The core issue arises specifically when developers configure multer with an asynchronous fileFilter function. In this configuration, the middleware initiates a filtering process that does not complete immediately but instead relies on callbacks to signal completion after performing potentially time-consuming operations such as disk I/O checks or external API validations. This architectural choice introduces a race condition related to request lifecycle management and stream state integrity.
The technical flaw manifests when an incoming HTTP request is aborted by the client before all asynchronous fileFilter functions have completed their execution. Under normal circumstances, multer manages internal streams that parse the multipart data and route files to designated storage engines. However, if the connection drops or the client disconnects during this window, multer attempts to tear down its internal parsing state to free resources and stop processing. The critical failure occurs because the asynchronous fileFilter callbacks remain pending in the event loop. When these delayed callbacks eventually execute, they attempt to resume control over a parsing stream that has already been destroyed by the middleware's cleanup routine. This results in an operation on a closed or invalid object, causing the underlying parser to emit an error event.
Because the internal state of multer indicates that the stream is no longer active and listening for errors, there are no registered error handlers attached to this specific stream instance at the moment the exception occurs. In Node.js environments, unhandled exceptions emitted on streams without corresponding listeners trigger a fatal process exit. Consequently, any single request utilizing an asynchronous fileFilter can cause the entire Node.js application server to crash if that request is aborted during processing. This behavior effectively creates a Denial of Service condition where malicious or even accidental client disconnections can destabilize the backend service. It is important to note that this vulnerability does not affect applications using synchronous fileFilters, as those complete before the stream teardown logic proceeds, thereby maintaining proper state synchronization between filtering and parsing phases.
From a classification perspective, this issue aligns with CWE-400 Uncontrolled Resource Consumption due to the potential for process termination affecting system availability, and more specifically reflects aspects of CWE-362 Concurrent Execution using Shared Resources with Improper Synchronization regarding the race condition between stream teardown and callback execution. In terms of MITRE ATT&CK mapping, this vulnerability facilitates Availability Impact through resource exhaustion or service disruption, categorized under techniques that target application stability rather than data confidentiality or integrity directly. The impact is severe for any production environment relying on multer for file uploads where clients may disconnect unexpectedly due to network instability or malicious intent aimed at disrupting services.
To mitigate this risk immediately, organizations should upgrade the multer dependency in their Node.js projects to version 2.5.0 or later, which contains patches ensuring that pending asynchronous callbacks are properly cancelled or ignored when streams are destroyed. For environments where an immediate upgrade is not feasible due to compatibility constraints with other dependencies, a viable workaround involves refactoring any custom fileFilter implementations to be synchronous. By removing async/await patterns or Promise-based logic from the filter function and performing checks synchronously within the callback scope, developers can prevent the race condition that leads to unhandled errors on destroyed streams. This approach ensures that filtering completes before stream teardown decisions are finalized, thereby preserving application stability during request aborts.