Multer Denial-of-Service Vulnerability via Incomplete Request Handling

A denial-of-service vulnerability has been identified in Multer, a Node.js middleware for processing multipart/form-data. This issue affects Multer versions prior to 2.1.0. The vulnerability allows attackers to send malformed requests that can lead to resource exhaustion, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by exhausting server resources.

Reproduction

The vulnerability can be reproduced by sending a malformed multipart/form-data request to a server using an affected version of Multer. This can be done by including orphaned files in the request, which the server may not properly clean up, leading to resource exhaustion.

Remediation

Users are advised to upgrade to Multer version 2.1.0 or later, where this vulnerability has been patched.