Detections
Analytics
SCA: security update for multer (GHSA-44fp-w29j-9vj5)
high Tenable Cloud Security Plugin ID 427730
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable
to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request
stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety
guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors.
Under sustained or repeated failure conditions, this can result in denial of service, requiring manual
server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users
should upgrade to 2.0.0 to receive a patch. No known workarounds are available. (CVE-2025-47935)
See Also
Plugin Details
Severity: High
ID: 427730
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 5/20/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.69
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2025-47935
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/19/2025
Vulnerability Publication Date: 5/19/2025
Reference Information
CVE: CVE-2025-47935
cwe: CWE-401