CVE-2025-47944
📛 CVE Title
Multer vulnerable to Denial of Service from maliciously crafted requests
Description
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- GitHub_M
- CVSS severity
- HIGH
- CVSS score
- 7.5 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Effective score
- 7.5 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-248 - Reserved
- 2025-05-14
- Published
- 2025-05-19 21:20 UTC
- Last updated
- 2025-05-20 15:13 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/47xxx/CVE-2025-47944.json
- Linked Threat
- CVE-2025-47944 — Multer vulnerable to Denial of Service from maliciously crafted requests
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2025-05-19 20:15:26 UTC
- NVD last modified
- 2026-06-17 09:28:52 UTC
- NVD CVSS v3.1
- 7.5 / 10 HIGH source: security-advisories@github.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 3.6 / 10
- EPSS score
- 0.0073 (probability of exploitation in next 30 days)
- EPSS percentile
- 50.61% vs all CVEs — higher = more likely to be exploited, as of 2026-08-06
NVD / KEV / EPSS data refreshed 2026-08-07 00:32 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2025-15796 - Assigner
- GitHub_M
- Published
- May 19, 2025, 7:20:45 PM
- Updated
- May 20, 2025, 1:13:49 PM
- EUVD base score (CVSS 3.1)
-
7.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EUVD-reported EPSS
- 0.0400
- Vendors
- expressjs
- Products
-
multer (1.4.4-lts.1, <2.0.0)
- Aliases
-
GHSA-4pg4-qvpc-4q3h
ENISA description: Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| expressjs | multer |
>=1.4.4-lts.1, <2.0.0 (affected)
|
— |
Vendor references (3)
References embedded in the original CVE record by the assigning CNA.
- https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h x_refsource_CONFIRM
- https://github.com/expressjs/multer/issues/1176 x_refsource_MISC
- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665 x_refsource_MISC
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665 security-advisories@github.com
- https://github.com/expressjs/multer/issues/1176 security-advisories@github.com
- https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h security-advisories@github.com
Indicators (1)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| domain |
node.js
|
no local data | 2026-05-18 21:19 UTC |
Remediations (25)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:www.progressiverobot.com
That gap is where patch reporting and real state disagree. KB5079473 is a cumulative update rather than a service, so there is nothing to restart - the fix takes effect only when the host reboots and the servicing stack completes the pending operations. Environment & Reproduction Reproduction targets Windows Server 2025 .
2026-09-16 23:44 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-09-16 23:44 UTC -
web:sec.cloudapps.cisco.com
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that ...
2026-09-16 23:44 UTC -
web:blogs.oracle.com
For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-09-16 23:44 UTC -
web:www.oracle.com
Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.
2026-09-16 23:44 UTC -
web:www.nist.gov
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.
2026-09-16 23:44 UTC -
web:www.cvefind.com
CVE Find is a real-time vulnerability database indexing 393 646 security flaws ( CVE ) from MITRE, NVD, CISA KEV, CWE and CAPEC. 4211 new CVEs were published in the last 7 days. Data aggregated from: MITRE Corporation ( CVE , CWE, CAPEC), National Vulnerability Database - NIST (NVD), CISA Known Exploited Vulnerabilities (KEV), FIRST (EPSS).
2026-09-16 23:44 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-22 14:02 UTC -
web:cybernoz.com
CVE - 2025 -42958: A missing authentication check in various SAP NetWeaver kernel versions, rated CVSS 9.1. SAP Security Patch Day The September 2025 patch release includes 21 new Security Notes and 5 updates to previously released notes. SAP has urged all customers to prioritize the installation of these patches to mitigate the risk of exploitation.
2026-05-22 14:02 UTC -
web:learn.microsoft.com
We manage Microsoft 365 Apps for Enterprise (Version 2409, Build 16829.20234) across 250 Windows 10/11 endpoints in an enterprise environment with Defender for Endpoint and Configuration Manager. Following the disclosure of CVE - 2025 -22944, a critical remote code execution vulnerability (CVSS 8.8) in Microsoft Office, we are urgently addressing risks from malicious file exploitation, which ...
2026-05-22 14:02 UTC -
web:thecyberexpress.com
SAP addresses CVE - 2025 -42944, a critical flaw in NetWeaver, with a CVSS 10.0 rating. Users urged to apply the September 2025 security patch immediately.
2026-05-22 14:02 UTC -
web:www.cybersecurity-now.co.uk
The September 2025 patch release includes 21 new Security Notes and 5 updates to previously released notes. SAP has urged all customers to prioritize the installation of these patches to mitigate the risk of exploitation.
2026-05-22 14:02 UTC -
web:www.ninjaone.com
Overview KB5087054 is a cumulative security and reliability update for the .NET Framework targeting Windows 11 version 24H2 systems. Released on May 12, 2026, this patch addresses critical vulnerabilities affecting both .NET Framework 3.5 and 4.8.1 installations. The update is designed to be deployed as part of standard maintenance routines and is available through multiple distribution ...
2026-05-22 14:02 UTC -
web:www.oracle.com
This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 14:02 UTC -
web:arcticwolf.com
SAP released its September 2025 Security Patch Day update with patches for 21 vulnerabilities. The most severe of these, CVE - 2025 -42944, is a maximum-severity deserialization vulnerability of untrusted Java objects in SAP NetWeaver that resides in the RMI-RP4 module.
2026-05-22 14:02 UTC -
web:github.com
Impact A vulnerability in Multer versions >=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Patches Users should upgrade to 2.0.0 Workarounds None References expressjs/multer#1176 expressjs/multer@ 2c8505f References GHSA-4pg4-qvpc-4q3h https ...
2026-05-22 02:52 UTC -
web:www.sentinelone.com
CVE-2025-47944 is a denial of service vulnerability in Multer middleware. Learn about its impact, affected versions, and mitigation methods.
2026-05-22 02:52 UTC -
web:www.facebook.com
Concord NH Patch . 44,188 likes · 3,578 talking about this. Hyperlocal news, alerts, discussions and events for Concord, NH
2026-05-22 02:52 UTC -
web:cve.akaoma.com
Users should upgrade to version 2.0.0 to receive a patch . No known workarounds are available. Assessing the Risk of CVE-2025-47944 Access Complexity Graph The exploitability of CVE-2025-47944 depends on two key factors: attack complexity (the level of effort required to execute an exploit) and privileges required (the access level an attacker ...
2026-05-22 02:52 UTC -
web:forums.ea.com
Broken and Updated Sims 4 Mods and CC: patch 1.124, May 12, 2026 About This Thread This thread tracks Sims 4 mods and CC that have been "broken" or made obsolete by game update 1.124, May 12, 2026, or declared unsupported by their creators.
2026-05-22 02:52 UTC -
web:nvd.nist.gov
This is a potential security issue, you are being redirected to https://nvd.nist.gov
2026-05-22 02:52 UTC -
web:support.microsoft.com
The Excel file also contains detailed fix lists. Download this Excel file now. Note: Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format.
2026-05-22 02:52 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-05-22 02:52 UTC -
web:vulert.com
CVE-2025-47944 CVE 2.0.0 Patch 7.5 CVSS Score Check whether your application is affected by this vulnerability? With just a manifest file (for example, package-lock.json), we can analyze your application's dependencies and generate a report.
2026-05-22 02:52 UTC -
web:vulmon.com
To address this security issue, users are recommended to upgrade to version 2.0.0, which provides a patch . Currently, no alternative mitigation strategies are available to prevent this vulnerability.
2026-05-22 02:52 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2025-47944.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-47944",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-20T13:13:42.761276Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-20T13:13:49.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "multer",
"vendor": "expressjs",
"versions": [
{
"status": "affected",
"version": ">=1.4.4-lts.1, <2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-19T19:20:45.401Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h"
},
{
"name": "https://github.com/expressjs/multer/issues/1176",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/expressjs/multer/issues/1176"
},
{
"name": "https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665"
}
],
"source": {
"advisory": "GHSA-4pg4-qvpc-4q3h",
"discovery": "UNKNOWN"
},
"title": "Multer vulnerable to Denial of Service from maliciously crafted requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-47944",
"datePublished": "2025-05-19T19:20:45.401Z",
"dateReserved": "2025-05-14T10:32:43.530Z",
"dateUpdated": "2025-05-20T13:13:49.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}