CVE-2025-7338 Multer vulnerable to Denial of Service via unhandled exception from malformed request

🗓️ 17 Jul 2025 15:26:45Reported by openjsType

Multer vulnerable to Denial of Service from malformed requests; upgrade to version 2.0.2 for patch

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in multer-2.0.1.tgz	22 Oct 202511:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	20 Nov 202504:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service [CVE-2025-7338] and loss of confidentiality [CVE-2025-36133]	1 Sep 202511:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages fixes multer package vulnerability (CVE-2025-7338)	6 Nov 202507:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by vulnerability found in Node.js (CVE-2025-7338)	28 Aug 202515:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in multer	30 Oct 202507:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in multer-2.0.1.tgz	26 Aug 202517:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data	16 Dec 202511:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Multer, form-data and on-headers (CVE-2025-7338, CVE-2025-7783 & CVE-2025-7339)	28 Aug 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.	3 Nov 202522:14	–	ibm

[
  {
    "defaultStatus": "unaffected",
    "product": "multer",
    "vendor": "expressjs",
    "versions": [
      {
        "lessThan": "2.0.2",
        "status": "affected",
        "version": "1.4.4-lts.1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p

17 Jul 2025 15:26Current

CVSS 3.17.5

EPSS0.0004

CWE-248