CVE-2026-113872

Name of the Vulnerable Software and Affected Versions multer versions 2.0.0 through 2.4.9

Description A race condition exists in the multipart parser when configured with an asynchronous fileFilter() function. If a request is aborted while an asynchronous fileFilter() is still pending, the callback may resume a parsing stream that has already been torn down. This causes the underlying parser to emit an error on a stream without an error listener, resulting in an unhandled error event that crashes the Node.js process, leading to a Denial of Service. This issue affects any application using an asynchronous fileFilter() regardless of the storage engine used.

Recommendations Update multer to version 2.5.0 or later. As a temporary workaround, use a synchronous fileFilter() function.