Asynchronous File Filter Vulnerability in multer Middleware for Node.js

CVE-2026-113872

What is CVE-2026-113872?

A vulnerability exists in the multer middleware used for handling multipart/form-data file uploads in Node.js. Specifically, in versions ranging from 2.0.0 up to 2.4.0, a misconfiguration with an asynchronous fileFilter can lead to a crash of the Node.js process. If a file upload request is aborted while the asynchronous fileFilter is still processing, the callback attempts to resume a parsing stream that multer has already terminated. Consequently, the underlying parser emits an error on this stream, leading to an unhandled error event and causing the process to exit unexpectedly. This issue affects all applications utilizing multer with an asynchronous fileFilter, regardless of their storage engine. The problem has been resolved in multer version 2.5.0, and it is advisable for users to upgrade to this version or later. Alternatively, for immediate relief, switching to a synchronous fileFilter can be employed as a workaround.

References