CVE-2025-47944 and CVE-2025-47935 DOS(Denial-of-service) Vulnerabilities # If your Node.js application handles file uploads using Multer and you’re not running version 2.0.0 or higher, you may be vulnerable.

With over 26.3 million monthly downloads, Multer is a go-to middleware for handling multipart/form-data in Node.js—especially for file uploads. But two newly disclosed vulnerabilities—CVE-2025-47944 and CVE-2025-47935—have exposed serious Denial of Service (DoS) risks to applications relying on this popular library.

If your Node.js application handles file uploads using Multer and you’re not running version 2.0.0 or higher, you may be vulnerable.

CVE-2025-47944 (CVSS 7.5): DoS via Malformed Multipart Requests >>>

This vulnerability affects Multer versions ≥ 1.4.4-lts.1 and allows an attacker to craft malicious multipart requests that crash the server.

“This request causes an unhandled exception, leading to a crash of the process,” the advisory explains.

The issue stems from Multer’s inability to safely handle specially crafted multipart payloads. Attackers don’t need authentication or elevated privileges—a single malformed upload request can bring down the server.

CVE-2025-47935 (CVSS 7.5): DoS via Memory Leaks from Unclosed Streams >>>

This second vulnerability hits all Multer versions < 2.0.0 and relates to unsafe stream handling:

“When the HTTP request stream emits an error, the internal busboy stream is not closed… This leads to unclosed streams accumulating over time, consuming memory and file descriptors,” the advisory exlains.

In essence, this creates a resource exhaustion vector. Unclosed streams continue to stack up under sustained upload errors, eventually requiring manual restarts to restore service.

This flaw is especially dangerous in high-throughput environments, where persistent upload failures—malicious or otherwise—can silently grind servers to a halt.