8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48997

CVE-2025-48997: Multer vulnerable to Denial of Service via unhandled exception

Impact

A vulnerability in Multer versions >=1.4.4-lts.1, <2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.

Patches

Users should upgrade to 2.0.1

Workarounds

None

References

https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9 https://github.com/expressjs/multer/issues/1233 https://github.com/expressjs/multer/pull/1256

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48997

CVE-2025-48997:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
multer	npm	>= 1.4.4-lts.1, < 2.0.1	2.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-g5hg-p3ph-g8qg and CVE-2025-48997, affects Multer versions >=1.4.4-lts.1 and <2.0.1. It allows an attacker to cause a Denial of Service (DoS) by sending a file upload request with an empty string field name. This action triggers an unhandled exception, crashing the application process.

The root cause, as revealed by the patch (commit 35a3272b611945155e046dd5cef11088587635e9), was insufficient validation of the fieldname within the file handling logic. The patch was applied to lib/make-middleware.js, specifically within the makeMiddleware function. This function sets up an event handler for busboy's 'file' event: busboy.on('file', function (fieldname, fileStream, ...) { ... }).

Before the patch, this event handler callback did not check if fieldname was null. If a request provided an empty or malformed field name that busboy (or an intermediate step) interpreted as null for the fieldname argument, the subsequent code within the callback would attempt to process it, leading to an unhandled exception and a process crash.

The fix introduces a check at the beginning of this callback: if (fieldname == null) return abortWithCode('MISSING_FIELD_NAME'). This ensures that if fieldname is null, the execution is gracefully handled by calling abortWithCode instead of proceeding to the vulnerable code path.

Therefore, the vulnerable function is effectively the anonymous callback for the busboy.on('file', ...) event, which is defined and managed within the scope of the makeMiddleware function. During runtime, an exploit would trigger the unhandled exception within this callback when it attempts to operate with a null fieldname.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48997: Multer vulnerable to Denial of Service via unhandled exception

Impact

Patches

Workarounds

References

CVE-2025-48997:

8.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-48997: Multer vulnerable to Denial of Service via unhandled exception

Impact

Patches

Workarounds

References

Technical Details

Basic Information

Basic Information

8.7

8.7

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI