Vulnpedia
← Search CVEs

CVE-2026-113872

HIGH 7.5

Published 2026-10-22 · Last modified 2026-10-22

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 38th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Multer

Products Multer

Weakness (CWE)

  • CWE-248: : Uncaught Exception
  • CWE-404: : Improper Resource Shutdown or Release

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • multer npm

    pkg:npm/multer

    SEMVER range
    • Introduced version (included): 2.0.0
    • Fixed boundary (excluded): 2.5.0
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q7qp-rjg7-q26m/GHSA-q7qp-rjg7-q26m.json"
  }
}
    GitHub Advisory Database · GHSA-q7qp-rjg7-q26m · Updated 2026-10-23T22:15:04.285056362Z

Vendor product assessments

  • 3scale-amp2/system-rhel8 as a component of Red Hat 3scale API Management Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/system-rhel8@sha256:2693e874d59879db44e63010e133b31ebbf0736e55c06fc00d5561bbec37d8e6?repository_url=registry.redhat.io/3scale-amp2/system-rhel8

    • none available: Affected
    Red Hat · CVE-2026-113872 · Updated 2026-10-22T22:36:13+00:00
  • rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend as a component of Red Hat Developer Hub · known affected

    Vendor assessment for this product only.

    pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:fd810ebe5995c4f8d211e145f40ff5f0c327506d598509a50a10a4b9728ca8df?repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend

    • none available: Affected
    Red Hat · CVE-2026-113872 · Updated 2026-10-22T22:36:13+00:00
  • rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend as a component of Red Hat Developer Hub · known affected

    Vendor assessment for this product only.

    pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:1757e2d71a48707d556308d31e84f6fd3d4ae36021c9321c0634c9af7290cbd5?repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend

    • none available: Affected
    Red Hat · CVE-2026-113872 · Updated 2026-10-22T22:36:13+00:00
  • rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub · known affected

    Vendor assessment for this product only.

    pkg:oci/rhdh-hub-rhel9@sha256:0f02ae0b8405912741a180af1c290feac2003e69d062bec9c7cd5d13f8732dc9?repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9

    • none available: Affected
    Red Hat · CVE-2026-113872 · Updated 2026-10-22T22:36:13+00:00
  • ansible-automation-platform/automation-portal as a component of Self-service automation portal 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/automation-portal@sha256:f46004acf3999418dc7bfae7dc05675095dd4fd482a0b1df55aed153b2a0789f?repository_url=registry.redhat.io/ansible-automation-platform/automation-portal

    • none available: Affected
    Red Hat · CVE-2026-113872 · Updated 2026-10-22T22:36:13+00:00
  • ansible-automation-platform/bootc-automation-portal-rhel9 as a component of Self-service automation portal 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-automation-portal-rhel9@sha256:8553c734145775879bdfe2befa9f2df1c22c6d7db2f2251401c3cc517a7e0394?repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9

    • none available: Affected
    Red Hat · CVE-2026-113872 · Updated 2026-10-22T22:36:13+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS