Multer is a middleware that parses multipart/form-data for Node.js applications. Versions prior to 2.1.0 allow an attacker to trigger a denial‑of‑service by sending malformed requests that cause the parser to exhaust resources; the library fails to complete cleanup when malformed data is received, corresponding to CWE‑459. This results in memory or CPU overconsumption that can render the hosting application unavailable to legitimate users.

The vulnerability is confined to the Multer component of Express.js applications. Any project using a Multer instance whose version is older than 2.1.0 is at risk, regardless of other middleware used. The risk applies globally to any endpoint that processes file uploads through Multer.

The CVSS score of 8.7 marks this as a high‑severity issue. The EPSS score, being less than 1%, indicates that exploitation attempts remain rare at present, and the vulnerability is not yet catalogued in CISA’s KEV. Attackers can exploit the weakness remotely via HTTP requests without authentication; by crafting multipart/form-data packets that trigger excessive resource usage, they can cause the target server to become unresponsive.