multer EUVD-2026-108188

The decisive precondition is explicit in the advisory: the target application must configure multer with an ASYNCHRONOUS fileFilter (a callback-style/async filter). Applications using a synchronous fileFilter are NOT affected, and the issue is independent of the storage engine. The trigger requires the attacker to abort an in-flight multipart request while another file's async fileFilter callback is still pending, so the application must expose a reachable multipart/form-data upload route. No authentication is required (CVSS PR:N; advisory states a single unauthenticated request suffices) and no user interaction is needed. The primary limiting factor is purely the async-fileFilter deployment choice; default multer usage with a synchronous filter eliminates the exposure.

This is a genuine availability risk but a conditional one, and the signals are mostly consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) correctly reflects a network-reachable, unauthenticated, availability-only impact (C:N/I:N/A:H) - the advisory confirms a single unauthenticated request can crash the Node.js process. The vuln.today decision label is 'this_week', consistent with a serious but non-emergency DoS. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - treat it as a prioritized patch, not an incident. No verified public exploit code was provided; the only references are the GHSA/OpenJSF advisories (advisory pages, not a working PoC). The one material caveat the raw CVSS score hides: exploitability is gated on the application being configured with an asynchronous fileFilter - deployments using a synchronous fileFilter are not affected at all, regardless of CVSS. So the 7.5 applies only to the subset of multer deployments using async filters; the base score does not encode that configuration dependency.

An unauthenticated attacker targets an HTTP endpoint of an Express/Node.js app that uses multer with an asynchronous fileFilter. The attacker sends a multipart/form-data upload with multiple files and aborts the request (e.g., when one file is rejected) while another file's async fileFilter callback is still pending; the pending callback then resumes a parsing stream multer has already torn down, busboy emits an error on a stream with no error listener, and Node raises an unhandled 'error' event that terminates the process. No public working exploit code was identified at time of analysis (only the vendor advisory reference exists).