CVE-2025-47935 (High) detected in multer-1.4.5-lts.2.tgz

[mend-bolt-for-github]

CVE-2025-47935 - High Severity Vulnerability

Vulnerable Library - multer-1.4.5-lts.2.tgz

Middleware for handling `multipart/form-data`.

Library home page: https://registry.npmjs.org/multer/-/multer-1.4.5-lts.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• gatsby-5.14.3.tgz (Root Library)
  • ❌ multer-1.4.5-lts.2.tgz (Vulnerable Library)

Found in HEAD commit: 774c842eb5c71d566876ba6cf897379f3353e1e8

Found in base branch: master

Vulnerability Details

Multer is a node.js middleware for handling "multipart/form-data". Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal "busboy" stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.

Publish Date: 2025-05-19

URL: CVE-2025-47935

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-44fp-w29j-9vj5

Release Date: 2025-05-19

Fix Resolution: https://github.com/expressjs/multer.git - v2.0.0

---

Step up your Open Source Security Game with Mend here