CVE-2026-113872 multer CVE debrief

Who should care

Defenders of applications using multer with asynchronous fileFilter should assess exposure and prioritize upgrading to multer 2.5.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update affected applications. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and

Why it matters

Defenders should care about CVE-2026-113872 because it affects applications using multer with asynchronous fileFilter, potentially leading to Denial of Service attacks. Upgrading to multer 2.5.0 or later is recommended.

• Potential Denial of Service attacks via a single unauthenticated request
• Crash of the Node.js process due to unhandled error event

Technical summary

multer is vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown. When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. The vulnerability is triggered when a request is aborted while another file's async fileFilter is still pending, causing the pending callback to resume a parsing stream that multer has already torn down. This issue can be mitigated by upgrading to multer 2.5.0 or later, or using a synchronous fileFilter as a workaround.

Defensive priority

Defenders should prioritize upgrading to multer 2.5.0 or later to prevent potential Denial of Service attacks.

Recommended defensive actions

• Upgrade to multer 2.5.0 or later
• Use a synchronous fileFilter as a workaround
• Review and update affected applications using multer with asynchronous fileFilter
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides details on the vulnerability in multer, including the impact, patches, and workarounds. However, the corpus does not provide information on exploitation or specific victims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.