Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Santihabib

#41724of 60,399
7.5Total CVSS
Vulnerabilities · 1
PT-2026-121400
2026-10-22
7.5
CVE-2026-113872
Npm
Multer
A race condition exists in the multipart parser when configured with an asynchronous `fileFilter()` function. If a request is aborted while an asynchronous `fileFilter()` is still pending, the callback may resume a parsing stream that has already been torn down. This causes the underlying parser to emit an error on a stream without an error listener, resulting in an unhandled error event that crashes the Node.js process, leading to a Denial of Service. This issue affects any application using an asynchronous `fileFilter()` regardless of the storage engine used.