Detections
Analytics

SCA: security update for multer (GHSA-q7qp-rjg7-q26m)

high Tenable Cloud Security Plugin ID 477214

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0
 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the
 Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the
 pending callback later resumes a parsing stream that multer has already torn down, and the underlying
 parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled
 error event so the process exits. Any application using multer with an asynchronous fileFilter is affected
 regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is
 fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous
 fileFilter. (CVE-2026-113872)

Solution

Update the multer library and its related packages to version 2.5.0 or later.

See Also

https://github.com/advisories/GHSA-q7qp-rjg7-q26m

Plugin Details

Severity: High

ID: 477214

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/24/2026

Updated: 10/24/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-113872

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-113872