Overview
The vulnerability CVE-2025-7338 pertains to Multer, a widely used middleware for handling multipart/form-data in Node.js. This vulnerability, present in versions 1.4.4-lts.1 to 2.0.1, could potentially allow an attacker to trigger a Denial of Service (DoS) attack, crashing the system and possibly leading to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-7338
Severity: High (7.5 CVSS)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Denial of Service, potential system compromise, and data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Multer | 1.4.4-lts.1 to 2.0.1
How the Exploit Works
An attacker can exploit this vulnerability by sending a malformed multi-part upload request to the server running a vulnerable version of Multer. This malformed request triggers an unhandled exception in the Multer middleware, which in turn causes the Node.js process to crash, resulting in a Denial of Service.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited using an HTTP request with a malformed multi-part body.
POST /upload HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="malformed_file"
Content-Type: application/octet-stream
{ "malicious_payload": "..." }
------WebKitFormBoundary7MA4YWxkTrZu0gW--The ‘malicious_payload’ would be crafted in a way that it causes the unhandled exception when parsed by the Multer middleware.
Please note this is a simplified example and actual exploit may involve complex and obfuscated malicious data.