multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
影響: npm:multer >= 2.0.0, < 2.5.0 → 2.5.0
When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is…
| CVE | CVE-2026-113872 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 07:08, GitHub Advisory Database에서 "multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-113872.