CVE-2026-113872: Unauthenticated Process Crash in Express Multer via Late Busboy Stream Resumption

Vulnerability ID: CVE-2026-113872
CVSS Score: 7.5
Published: 2026-10-23

CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) is a high-severity denial-of-service vulnerability affecting the multer multipart/form-data upload middleware for Node.js and Express in versions 2.0.0 through 2.4.0. When an endpoint is configured to accept multiple files using an asynchronous fileFilter callback, a crafted, truncated multipart HTTP request can trigger an unhandled error event on the underlying busboy stream parser after request teardown has already completed. Because all error listeners are stripped during teardown, Node.js treats the resulting error event as an uncaught exception and immediately terminates the server process.

TL;DR

A lifecycle race condition between stream teardown and asynchronous fileFilter execution in multer (>= 2.0.0, < 2.5.0) allows an unauthenticated attacker to crash the Node.js server process with a single truncated multipart/form-data HTTP request.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
• Affected Component: multer npm package (>= 2.0.0, < 2.5.0)
• Weakness Class: CWE-248 (Uncaught Exception) / CWE-404 (Improper Resource Shutdown)
• Attack Vector: Network (Unauthenticated HTTP multipart/form-data POST)
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• EPSS Score: 0.44% (37.31th Percentile)
• Impact: Complete Node.js application process crash (Denial of Service)
• Exploit Status: Public Proof-of-Concept Available (CISA KEV: False)

Affected Systems

• Node.js applications using Express multer middleware (>= 2.0.0, < 2.5.0)
• multer: >= 2.0.0, < 2.5.0 (Fixed in: 2.5.0)

Code Analysis

Commit: 80a2d9d

fix: swallow late busboy error after teardown

diff --git a/lib/make-middleware.js b/lib/make-middleware.js
index 6be71a15..1cce8e1a 100644
--- a/lib/make-middleware.js
+++ b/lib/make-middleware.js
@@ -160,6 +160,9 @@ function makeMiddleware (setup) {
         req.unpipe(busboy)
         setImmediate(() => {
           busboy.removeAllListeners()
+          // Keep an error listener so a late busboy error after teardown cannot
+          // crash the process; the request has already finished.
+          busboy.on('error', function () {})
         })
       }
       drainStream(req)

Exploit Details

• GitHub: Public Proof-of-Concept repository by vulnerability reporter Santiago Habib containing a vulnerable Express server, multipart payload generator, and automated verification harness.

Mitigation Strategies

• Upgrade the multer package to patched version 2.5.0 or higher across all Node.js services.
• Refactor asynchronous fileFilter callbacks into synchronous checks (such as MIME type or extension validation) and move asynchronous operations (database queries, virus scans, HTTP requests) into downstream Express route handlers.
• Configure process supervisors (e.g., systemd, PM2, Kubernetes liveness probes) and rate-limiting reverse proxies to improve availability resilience against malformed upload flooding.

Remediation Steps:

1. Audit package.json and package-lock.json files to identify installations of multer in the vulnerable range (>= 2.0.0, < 2.5.0).
2. Run npm install multer@^2.5.0 (or the equivalent yarn/pnpm command) to install the patched release.
3. Verify via the regression test pattern in test/async-file-filter-teardown-crash.js that truncated multi-file uploads with asynchronous fileFilters no longer terminate the Node.js process.
4. If upgrading is blocked, audit all multer({ fileFilter }) configurations and remove any asynchronous calls (async/await, Promise, setTimeout, or I/O callbacks) prior to invoking cb().

References

• CVE-2026-113872 Record (CVE.org)
• GitHub Security Advisory GHSA-q7qp-rjg7-q26m
• National Vulnerability Database (NVD) - CVE-2026-113872
• Open Source Vulnerabilities (OSV) - GHSA-q7qp-rjg7-q26m
• OpenJS Foundation CNA Security Advisories
• Official Security Patch Commit (80a2d9df1dfd63b5fab631b8b9966164ed647adf)
• Multer Release v2.5.0
• Express Multer GitHub Repository
• Proof-of-Concept & Research Repository by Santiago Habib

Read the full report for CVE-2026-113872 on our website for more details including interactive diagrams and full exploit analysis.