CVE-2025-7338: Multer Denial of Service Vulnerability via Malformed Request
Summary
CVE-2025-7338: Multer vulnerable to Denial of Service via unhandled exception from malformed request. Affects multer versions >= 1.4.4-lts.1, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Multer is a middleware for handling multipart/form-data, primarily used for uploading files in Node.js applications. It simplifies the process of handling file uploads and provides various features such as file size limits and storage options. However, certain versions of Multer are vulnerable to a Denial of Service (DoS) attack due to unhandled exceptions triggered by malformed requests.
Vulnerability Detail
A vulnerability exists in Multer versions >= 1.4.4-lts.1 and < 2.0.2 that allows attackers to send malformed requests. These requests can cause unhandled exceptions, leading to the crashing of the application process. This vulnerability can be exploited to disrupt service availability, making it critical for developers to address it promptly.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
npm install multer@2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no workarounds available for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The vulnerability identified as CVE-2025-7338 in Multer poses a significant risk of Denial of Service due to unhandled exceptions from malformed requests. Users are strongly advised to upgrade to version 2.0.2 to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for multer →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Multer versions >= 1.4.4-lts.1 and < 2.0.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If left unaddressed, this vulnerability can lead to Denial of Service attacks, causing your application to crash and become unavailable to users.
Currently, there are no specific workarounds available. The recommended action is to upgrade to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for multer.
