{"schema":"vulnpedia.research/1","cve":"CVE-2026-113872","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m","tags":["WEB","vendor-reference"],"source":"mitre","sourceId":"openjs","modified":"2026-10-22T14:20:18.363Z","origins":[{"source":"mitre","sourceId":"openjs","modified":"2026-10-22T14:20:18.363Z","url":"https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"},{"source":"nvd","sourceId":"CVE-2026-113872","modified":"2026-10-22T19:17:36.023","url":"https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"}]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["WEB","vendor-reference"],"source":"mitre","sourceId":"openjs","modified":"2026-10-22T14:20:18.363Z","origins":[{"source":"mitre","sourceId":"openjs","modified":"2026-10-22T14:20:18.363Z","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"nvd","sourceId":"CVE-2026-113872","modified":"2026-10-22T19:17:36.023","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://cna.openjsf.org/security-advisories.html"}]},{"url":"https://osv.dev/vulnerability/GHSA-q7qp-rjg7-q26m","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://osv.dev/vulnerability/GHSA-q7qp-rjg7-q26m"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://osv.dev/vulnerability/GHSA-q7qp-rjg7-q26m"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113872","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113872"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113872"},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113872"}]},{"url":"https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf"}]},{"url":"https://github.com/expressjs/multer","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://github.com/expressjs/multer"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://github.com/expressjs/multer"}]},{"url":"https://github.com/expressjs/multer/releases/tag/v2.5.0","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://github.com/expressjs/multer/releases/tag/v2.5.0"},{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://github.com/expressjs/multer/releases/tag/v2.5.0"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-113872","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-113872"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559046","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559046"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113872","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-113872"}]},{"source":"euvd","sourceId":"EUVD-2026-108188","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108188","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-108188","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108188"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","url":"https://osv.dev/vulnerability/GHSA-q7qp-rjg7-q26m","ecosystem":"npm","name":"multer","purl":"pkg:npm/multer","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.5.0"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q7qp-rjg7-q26m/GHSA-q7qp-rjg7-q26m.json"},"modified":"2026-10-23T22:15:04.285056362Z","origins":[{"source":"ghsa","sourceId":"GHSA-q7qp-rjg7-q26m","modified":"2026-10-23T22:15:04.285056362Z","url":"https://osv.dev/vulnerability/GHSA-q7qp-rjg7-q26m"}]}],"pocCandidates":[{"url":"https://github.com/santihabib/multer-CVE-2026-113872","source":"poc-in-github","sourceId":"CVE-2026-113872","description":"Write-up and proof of concept for CVE-2026-113872: multer async fileFilter process crash (DoS)","modified":"2026-10-23T10:02:51Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-113872","url":"https://github.com/santihabib/multer-CVE-2026-113872"},{"source":"poc-in-github","sourceId":"CVE-2026-113872","modified":"2026-10-23T10:02:51Z","url":"https://github.com/santihabib/multer-CVE-2026-113872"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json","productId":"red_hat_3scale_api_management_platform_2:3scale-amp2/system-rhel8","product":"3scale-amp2/system-rhel8 as a component of Red Hat 3scale API Management Platform 2","status":"known_affected","remediations":[{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/system-rhel8@sha256:2693e874d59879db44e63010e133b31ebbf0736e55c06fc00d5561bbec37d8e6?repository_url=registry.redhat.io/3scale-amp2/system-rhel8","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json"}]},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json","productId":"red_hat_developer_hub:rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend","product":"rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:fd810ebe5995c4f8d211e145f40ff5f0c327506d598509a50a10a4b9728ca8df?repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json"}]},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json","productId":"red_hat_developer_hub:rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend","product":"rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:1757e2d71a48707d556308d31e84f6fd3d4ae36021c9321c0634c9af7290cbd5?repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json"}]},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json","productId":"red_hat_developer_hub:rhdh/rhdh-hub-rhel9","product":"rhdh/rhdh-hub-rhel9 as a component of Red Hat Developer Hub","status":"known_affected","remediations":[{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/rhdh-hub-rhel9@sha256:0f02ae0b8405912741a180af1c290feac2003e69d062bec9c7cd5d13f8732dc9?repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json"}]},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json","productId":"self-service_automation_portal_2:ansible-automation-platform/automation-portal","product":"ansible-automation-platform/automation-portal as a component of Self-service automation portal 2","status":"known_affected","remediations":[{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/automation-portal@sha256:f46004acf3999418dc7bfae7dc05675095dd4fd482a0b1df55aed153b2a0789f?repository_url=registry.redhat.io/ansible-automation-platform/automation-portal","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json"}]},{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json","productId":"self-service_automation_portal_2:ansible-automation-platform/bootc-automation-portal-rhel9","product":"ansible-automation-platform/bootc-automation-portal-rhel9 as a component of Self-service automation portal 2","status":"known_affected","remediations":[{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/bootc-automation-portal-rhel9@sha256:8553c734145775879bdfe2befa9f2df1c22c6d7db2f2251401c3cc517a7e0394?repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-113872","modified":"2026-10-22T22:36:13+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113872.json"}]}],"vendorCoverage":{"total":6,"shown":6,"omitted":0,"source":"redhat"}}