Denial of Service Vulnerability in Multer by Express.js

CVE-2025-7338

What is CVE-2025-7338?

Multer, a Node.js middleware library for handling multipart/form-data, is susceptible to a Denial of Service (DoS) vulnerability. This issue exists from version 1.4.4-lts.1 and earlier, where an attacker can exploit the system by sending a malformed multipart upload request. Such a request triggers an unhandled exception, causing the application process to crash. To mitigate the risk, users are strongly advised to update to version 2.0.2, which contains the necessary patches to resolve this issue. Currently, there are no alternative workarounds available.

References