CVE-2026-113872: CVE-2026-113872: Unauthenticated Process Crash in Express Multer via Late Busboy Stream Resumption

CVE-2026-113872 is a critical denial-of-service vulnerability affecting the multer npm package, specifically versions 2.0.0 through 2.4.0. When using multer with an asynchronous fileFilter callback in an endpoint configured to accept multiple files via multipart/form-data requests, a carefully crafted, truncated HTTP POST request can cause an unhandled error event to occur after the request has already ended.

This error event, which all error listeners are stripped during teardown, is treated as an uncaught exception by Node.js and results in immediate termination of the server process. The vulnerability has a CVSS score of 7.5, classified as high severity. The affected component is the multer npm package within the Node.js and Express framework ecosystem.

The exploit requires only a single HTTP request and can be performed without authentication, making it particularly dangerous. Affected Node.js applications acting as servers can be completely crashed by this attack, resulting in a Denial of Service condition. The vulnerability was publicly disclosed on October 23, 2026, and a proof-of-concept exploit is available in the form of a GitHub repository by researcher Santiago Habib.

To mitigate the risk, it is strongly recommended that all Node.js services using the vulnerable versions of multer upgrade immediately to version 2.5.0 or later. This patched release addresses the issue by preventing the late busboy stream error from crashing the process during teardown.