8.7

CVE-2025-48997: expressjs multer Uncaught Exception

CVSS: 8.7v4.0HighDeferred
AliasesCGA-qxwj-g87m-j5mjCGA-xg2h-hx8w-6m58GHSA-g5hg-p3ph-g8qg
Published 03-06-2025Last modified 03-06-2025
Open JSON

Vulnerability summary

CVE-2025-48997 is a high (CVSS 8.7) Uncaught Exception vulnerability in expressjs multer. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-QMRP-5VVJ-R7PR

Timeline

  1. 03-06-2025
    PublishedVulnerability first disclosed.
  2. 03-06-2025
    Last modifiedVulnerability information updated.

Description

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

0.00 pp

From 0.44% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard1 product
  • grafana-image-renderer< 3.12.6-r1
Expressjs1 product
  • multer≥ 1.4.4-lts.1, < 2.0.1
Npm1 product
  • multer≥ 1.4.4-lts.1, < 2.0.1
Wolfi1 product
  • grafana-image-renderer< 3.12.6-r1

4 vendors · 4 products

References

7 links