Node.js CVE-2025-48997

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) indicates this is a network-accessible vulnerability requiring no authentication or user interaction with low attack complexity, resulting in high availability impact but no confidentiality or integrity compromise. The risk assessment presents a nuanced picture: while CVSS 8.7 suggests critical severity, this is specifically a DoS vector with no data exfiltration or system compromise risk. Real-world risk depends heavily on deployment context—public-facing file upload endpoints are highest risk, while internal or rate-limited file upload services are lower risk. The lack of any integrity or confidentiality impact limits this to availability concerns, making it operationally disruptive rather than a data breach vector. Without confirmed KEV status, active exploitation reports, or public POC availability, this appears to be a legitimate but not yet weaponized vulnerability. The EPSS score (if calculated) would likely reflect moderate-to-high exploitation probability due to attack simplicity and broad Multer adoption, but actual risk prioritization should factor in exposure (how many endpoints use Multer) and deployment resilience (process restart monitoring, orchestration, load balancer failover).

An attacker identifies a Node.js application using Multer for file uploads (e.g., image/document upload feature). The attacker crafts a multipart/form-data HTTP POST request with a file attachment but sets the form field name to an empty string (""). The request is sent to the vulnerable endpoint. Upon processing, Multer's form field name validation fails to handle the empty string case, raising an unhandled exception in the Node.js event loop. The exception crashes the entire application process, causing a brief service outage until the application is restarted (either manually or by orchestration/process manager). If the attacker repeats this request at intervals, they can trigger repeated crashes, resulting in sustained DoS. Attack complexity is minimal—no special tools required beyond a basic HTTP client (curl, Postman, Python requests), and no authentication or interaction needed. The attack is practical and low-cost, making it a viable DoS vector for any publicly exposed Multer-based upload endpoint.