expressjs multer up to 2.0.0 Upload File uncaught exception

Summaryinfo

A vulnerability labeled as problematic has been found in expressjs multer up to 2.0.0. The affected element is an unknown function of the component Upload File Handler. Executing a manipulation can lead to uncaught exception. This vulnerability is registered as CVE-2025-48997. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in expressjs multer up to 2.0.0. It has been declared as problematic. This vulnerability affects an unknown part of the component Upload File Handler. The manipulation with an unknown input leads to a uncaught exception vulnerability. The CWE definition for the vulnerability is CWE-248. An exception is thrown from a function, but it is not caught. As an impact it is known to affect availability. CVE summarizes:

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-48997 since 05/29/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.0.1 eliminates this vulnerability. Applying the patch 35a3272b611945155e046dd5cef11088587635e9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-16780). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• expressjs

Name

• multer

Version

• 2.0

License

• open-source

Website

• Product: https://github.com/expressjs/multer/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion