{"id":86400,"date":"2026-02-06T19:01:11","date_gmt":"2026-02-06T19:01:11","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-47935-resource-exhaustion-and-memory-leak-vulnerability-in-multer-prior-to-2-0-0","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-47935-resource-exhaustion-and-memory-leak-vulnerability-in-multer-prior-to-2-0-0\/","title":{"rendered":"CVE-2025-47935: Resource Exhaustion and Memory Leak Vulnerability in Multer Prior to 2.0.0<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability CVE-2025-47935 pertains to Multer, a node.js middleware for handling multipart\/form-data. This vulnerability potentially affects all users of Multer that process file uploads. The issue arises from poor stream handling, leading to a resource exhaustion and memory leak, which could result in a denial of service and necessitate manual server restarts. This is a significant threat as it could result in potential system compromise or data leakage.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-47935
\nSeverity: High (7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Denial of Service, Potential System Compromise, Data Leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Multer | Less than 2.0.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of a flaw in Multer versions prior to 2.0.0. When the HTTP request stream emits an error, the internal ‘busboy’ stream is not properly closed. This violates Node.js’ stream safety guidance. Over time, the accumulation of these unclosed streams leads to memory and file descriptor consumption, causing a resource exhaustion and memory leak. Under sustained or repeated failure conditions, this can result in a denial of service attack.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

This conceptual example demonstrates a simple request that could trigger the vulnerability:<\/p>\n

POST \/upload HTTP\/1.1\nHost: target.example.com\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"file\"; filename=\"malicious_file.txt\"\nContent-Type: text\/plain\n[Malicious content]\n------WebKitFormBoundary7MA4YWxkTrZu0gW--<\/code><\/pre>\n
After this request, an error is emitted, leading to an unclosed stream, which if repeated could lead to a denial of service.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The vulnerability CVE-2025-47935 pertains to Multer, a node.js middleware for handling multipart\/form-data. This vulnerability potentially affects all users of Multer that process file uploads. The issue arises from poor stream handling, leading to a resource exhaustion and memory leak, which could result in a denial of service and necessitate manual server restarts. This is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86400","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t