CVE-2026-113872: Unauthenticated Process Crash in Express Multer via Late Busboy Stream Resumption

Vulnerability ID: CVE-2026-113872

CVSS Score: 7.5

Published: 2026-10-23

CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) is a high-severity denial-of-service vulnerability affecting the multer multipart/form-data upload middleware for Node.js and Express in versions 2.0.0 through 2.4.0. When an endpoint is configured to accept multiple files using an asynchronous fileFilter callback, a crafted, truncated multipart HTTP request can trigger an unhandled error event on the underlying busboy stream parser after request teardown has already completed.…