CVE-2025-47944: Multer vulnerable to Denial of Service from maliciously crafted requests

May 19, 2025

A vulnerability in Multer versions >=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process.

References

github.com/advisories/GHSA-4pg4-qvpc-4q3h
github.com/expressjs/multer
github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
github.com/expressjs/multer/issues/1176
github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h
nvd.nist.gov/vuln/detail/CVE-2025-47944

Code Behaviors & Features

Detect and mitigate CVE-2025-47944 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →