CVE-2025-48997highCWE-248

CVE-2025-48997: falha de alta gravidade em expressjs multer

Multer vulnerable to Denial of Service via unhandled exception

Publicada em

Seguir esta CVE+ Monitorar multer+ Monitorar multer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.5%
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
expressjs · multer
CVEs relacionadas — expressjs multer

No mesmo produto, das mais perigosas para as menos.

CVE-2026-3520HIGHMulter vulnerable to Denial of Service via uncontrolled recursionEPSS 0.8%CVE-2025-47944HIGHMulter vulnerable to Denial of Service from maliciously crafted requestsEPSS 0.8%CVE-2025-7338HIGHMulter vulnerable to Denial of Service via unhandled exception from malformed requestEPSS 0.8%CVE-2025-47935HIGHMulter vulnerable to Denial of Service via memory leaks from unclosed streamsEPSS 0.8%CVE-2026-3304HIGHMulter vulnerable to Denial of Service via incomplete cleanupEPSS 0.7%CVE-2026-2359HIGHMulter vulnerable to Denial of Service via resource exhaustionEPSS 0.7%