PatchTheCVECVE-2026-113872: multer is a middleware for Node.js that handles multipart/form-data file uploads
CVE-2026-113872 is a high-severity flaw (CVSS 7.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: santihabib/multer-CVE-2026-113872 (0 stars)
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.