« Volver al listado

CVE-2025-47935

Estado: AplazadaAlta (7.5)—

Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/AC:L/PR:N/UI:N indica explotación remota de aplicación expuesta (T1190). Resource exhaustion con memory leak y file descriptor depletion es DoS por consumo de recursos (T1499.004); CWE-401 (improper stream handling) sustenta el impacto de agotamiento.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Expressjs — MulterAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47935",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47935",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-20T14:29:22.955614Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "expressjs",
          "product": "multer",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-19T20:15:25.863",
  "references": [
    {
      "url": "https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/expressjs/multer/pull/1120",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "Multer es un middleware de Node.js para gestionar `multipart/form-data`. Las versiones anteriores a la 2.0.0 son vulnerables a problemas de agotamiento de recursos y fugas de memoria debido a un manejo inadecuado de los flujos. Cuando el flujo de solicitud HTTP emite un error, el flujo interno `busboy` no se cierra, lo que infringe las normas de seguridad de flujos de Node.js. Esto provoca la acumulación de flujos sin cerrar, consumiendo memoria y descriptores de archivo. En caso de fallos continuos o repetidos, esto puede provocar una denegación de servicio, lo que requiere reinicios manuales del servidor para la recuperación. Todos los usuarios de Multer que gestionan la carga de archivos se ven potencialmente afectados. Los usuarios deben actualizar a la versión 2.0.0 para recibir una actualización. No se conocen workarounds."
    }
  ],
  "lastModified": "2026-06-17T09:28:51.707",
  "sourceIdentifier": "security-advisories@github.com"
}