CVE-2025-7338: 
JavaScript vulnerability analysis and mitigation

CVE-2025-7338 is a Denial of Service (DoS) vulnerability in Multer, a Node.js middleware for handling multipart/form-data requests. Affecting versions >= 1.4.4-lts.1 and < 2.0.2, the flaw allows an unauthenticated remote attacker to crash the application process by sending a malformed multipart upload request that triggers an unhandled exception. The vulnerability was disclosed on July 17, 2025, with a patch available in version 2.0.2. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat).

The root cause is classified as CWE-248 (Uncaught Exception): when Multer processes a malformed multipart request with a bad or truncated boundary, a file stream error is emitted before the pendingWrites counter is incremented, causing the error handler to call pendingWrites.decrement() on an uninitialized state and throwing an unhandled exception that crashes the Node.js process. The fix (commit adfeaf6) restructures the file stream error handler to only decrement pendingWrites if it was previously incremented, and adds proper error propagation via abortWithError() (Github Advisory, Patch Commit). No authentication or user interaction is required to trigger the vulnerability, as any endpoint using Multer middleware for file uploads is exposed to network-accessible attackers.

Successful exploitation causes the Node.js application process to crash, resulting in complete loss of availability for the affected service. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (DoS). Applications relying on Multer for file upload handling (including downstream products such as IBM Rapid Infrastructure Automation, IBM API Connect, Splunk User Behavior Analytics, and HCL BigFix SaaS Remediate) are affected, and repeated exploitation could prevent service recovery without process supervision (Github Advisory, Red Hat).

A proof-of-concept (PoC) exploit is publicly available on GitHub (PoC Repo), demonstrating the crash via a crafted malformed multipart request with an intentionally truncated boundary. As of the time of disclosure, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.038–0.041% (13th percentile), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify target: Locate a Node.js web application using Multer versions >= 1.4.4-lts.1 and < 2.0.2 that exposes a file upload endpoint (e.g., via upload.single(), upload.array(), or similar middleware).
2. Craft malformed multipart request: Construct an HTTP POST request with a Content-Type: multipart/form-data header specifying a boundary, but include a body where the final boundary is intentionally truncated or malformed (e.g., missing the last character: ------FormBoundar instead of ------FormBoundary).
3. Send the request: Transmit the crafted request to the target upload endpoint using tools such as curl, Python's requests library, or a custom HTTP client. No authentication is required.
4. Trigger crash: The malformed boundary causes Multer's busboy parser to emit a file stream error before pendingWrites is incremented; the unhandled exception propagates and crashes the Node.js process, taking down the application (Github Advisory, Patch Commit).

• Logs: Unexpected Node.js process crash logs with an unhandled exception or Unexpected end of form error originating from Multer/busboy middleware; application restart events in process manager logs (e.g., PM2, systemd).
• Network: Repeated HTTP POST requests to file upload endpoints with malformed Content-Type: multipart/form-data boundaries or truncated multipart bodies from the same or rotating source IPs.
• Process: Sudden termination of the Node.js application process without a graceful shutdown signal; increased frequency of process restarts correlated with inbound upload requests.

The only available remediation is to upgrade Multer to version 2.0.2 or later, which includes the fix for improper error handling in the file stream event handler (Github Advisory). No configuration-based workarounds are available for vulnerable versions. As a temporary defensive measure while patching, operators should implement rate limiting and request size restrictions on file upload endpoints, and ensure a process supervisor (e.g., PM2, systemd) is configured to automatically restart the application after a crash. Downstream products including IBM Rapid Infrastructure Automation, IBM API Connect, and Splunk User Behavior Analytics have also released or are releasing updates addressing this dependency (IBM Advisory, Splunk Advisory).

The OpenJS Foundation (CNA for this CVE) and the Multer maintainers published the advisory and patch on July 17, 2025. Maintainer UlisesGascon posted about the release on Bluesky, and the OpenJS Foundation's official account also shared the advisory. The vulnerability received coverage in security news outlets including Heise (in the context of affected downstream products like HCL BigFix and IBM App Connect Enterprise) and was included in CISA's weekly vulnerability bulletin for the week of July 14, 2025 (CISA Bulletin).