CVE-2025-47935

Executive Summary

CVE-2025-47935 is a high-severity vulnerability in the Multer middleware for Node.js, affecting versions prior to 2.0.0. The flaw resides in improper stream handling when an HTTP request stream emits an error. In such cases, the internal busboy stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in a denial of service (DoS), requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. No known workarounds are available, and the only remediation is upgrading to version 2.0.0.

Supply Chain & Package Security

This vulnerability affects the Multer npm package, a widely used middleware for handling multipart/form-data in Node.js applications. The issue is introduced through improper stream lifecycle management, which can be exploited by an attacker sending malformed or error-inducing HTTP requests. Since Multer is a direct dependency in many web applications, the supply chain risk is significant. Organizations must audit their package.json and package-lock.json files to ensure Multer is updated to version 2.0.0 or later. Additionally, any transitive dependencies that rely on Multer should be reviewed.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is rated high due to its low attack complexity, no required privileges or user interaction, and the potential for a complete denial of service. An attacker can repeatedly send error-inducing requests to exhaust server resources, leading to service unavailability.

Deep Dive & Mechanics

The vulnerability arises from improper stream handling in Multer's integration with the busboy library. When an HTTP request stream emits an error (e.g., due to a malformed multipart/form-data payload), the internal busboy stream is not properly closed. According to Node.js stream safety guidance, streams should be closed or destroyed when an error occurs to prevent resource leaks. In this case, the unclosed streams accumulate over time, consuming memory and file descriptors. Under sustained attack, this leads to resource exhaustion and denial of service.

The root cause is in the error handling logic within Multer's middleware. When the request stream emits an error event, the code fails to call busboy.destroy() or req.unpipe(busboy), leaving the stream in an open state. This violates the principle of proper stream lifecycle management in Node.js.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.0.0):

// Simplified vulnerable pattern
app.post('/upload', (req, res) => {
  const busboy = new Busboy({ headers: req.headers });
  req.pipe(busboy);
  
  req.on('error', (err) => {
    // Missing: busboy.destroy() or req.unpipe(busboy)
    res.status(500).end('Error');
  });
  
  busboy.on('file', (fieldname, file, filename) => {
    // Handle file
  });
});

Patched Code (2.0.0):

// Patched version
app.post('/upload', (req, res) => {
  const busboy = new Busboy({ headers: req.headers });
  req.pipe(busboy);
  
  req.on('error', (err) => {
    busboy.destroy(); // Properly close the stream
    res.status(500).end('Error');
  });
  
  busboy.on('file', (fieldname, file, filename) => {
    // Handle file
  });
});

The patch adds busboy.destroy() in the error handler, ensuring the internal stream is closed and resources are freed.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Set up a vulnerable Node.js application using Multer < 2.0.0.
2. Use a tool like curl or a custom script to send malformed multipart requests.

Exploitation Steps:

1. Identify a target endpoint that uses Multer for file uploads.
2. Send a series of HTTP requests with malformed multipart/form-data payloads that trigger stream errors (e.g., incomplete headers, invalid boundaries).
3. Monitor server resource usage (memory, file descriptors) to observe exhaustion.
4. Continue sending requests until the server becomes unresponsive.

Example Malformed Request:

curl -X POST http://target/upload \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
  --data-binary @malformed_payload.txt

Where malformed_payload.txt contains an incomplete multipart body.

Blue Team

Detection:

• Monitor for a high rate of HTTP 500 errors from file upload endpoints.
• Track memory and file descriptor usage on servers handling file uploads.
• Look for repeated requests with malformed multipart payloads.

Mitigation:

• Immediately upgrade Multer to version 2.0.0.
• Implement rate limiting on file upload endpoints.
• Use a Web Application Firewall (WAF) to filter malformed multipart requests.
• Enable monitoring and alerting for resource exhaustion.

Indicators of Compromise (IOCs)

• Network: Repeated HTTP requests to file upload endpoints with malformed multipart payloads.
• System: High memory usage and file descriptor consumption on Node.js servers.
• Logs: Frequent HTTP 500 errors from Multer-related routes.
• Process: Node.js processes consuming excessive memory over time.

Detection Engineering

YARA Rule

rule CVE_2025_47935_Multer_Stream_Leak {
  meta:
    description = "Detects vulnerable Multer versions in package.json"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-47935"
  strings:
    $package = "multer"
    $version = /"version":\s*"([0-1]\.\d+\.\d+)"/ nocase
  condition:
    $package and $version
}

Sigma Rule

title: CVE-2025-47935 Multer Resource Exhaustion
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2025-47935 via repeated malformed upload requests
logsource:
  category: webserver
  product: nodejs
detection:
  selection:
    status: 500
    path: /upload
    method: POST
  condition: selection | count() > 100 in 5m
falsepositives:
  - Legitimate upload errors
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47935 Multer Malformed Multipart Request"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"multipart/form-data"; http_header; pcre:"/\\r\\n--[^\\r\\n]+\\r\\n(?!.*\\r\\n--[^\\r\\n]+--)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Multer to version 2.0.0 or later.
2. Restart all affected Node.js servers to clear any leaked resources.

Long-term Measures:

• Implement automated dependency scanning to detect vulnerable packages.
• Use a Web Application Firewall (WAF) to filter malformed multipart requests.
• Apply rate limiting and request validation on file upload endpoints.
• Monitor server resource usage and set up alerts for anomalies.

Workarounds:

• No known workarounds are available. The only fix is upgrading to version 2.0.0.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence.