Multer DoS flaw CVE-2026-113872 lets one request crash Node.js servers

CVE-2026-113872 (CVSS 7.5) in the multer upload middleware for Node.js and Express 2.0.0–2.4.0 lets an unauthenticated attacker crash the server process with a single truncated multipart request. The race occurs with asynchronous fileFilter callbacks during stream teardown; the fix ships in multer 2.5.0.

• Affects multer >= 2.0.0 and < 2.5.0, fixed in 2.5.0
• CVSS 7.5 with a public PoC, not in CISA KEV
• Attack is one unauthenticated truncated multipart/form-data POST
• Workaround: synchronous fileFilter without async calls