CVE-2026-113872

About vulnerability

Impact

When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file’s async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is enough, so any application using multer with an asynchronous fileFilter is affected, regardless of storage engine. Uploads using a synchronous fileFilter are not affected.

Patches

Users should upgrade to multer 2.5.0 or later.

Workarounds

Use a synchronous fileFilter.

Affected product:

allure-codeceptjs , babel-plugin-remove-graphql-queries , codeceptjs , configure , gatsby , gatsby-plugin-compile-es6-packages , gatsby-plugin-fathom , gatsby-plugin-page-creator , gatsby-plugin-react-helmet , gatsby-plugin-sharp , gatsby-source-filesystem , multer , nestjs-core , nestjs-platform-express , sentry-gatsby

Affected packages:

multer @ 2.2.0 (+83 more)