A flaw in the Node.js middleware Multer allows an attacker to cause a stack overflow by sending specially crafted multipart/form‑data requests. The unchecked recursion in the parsing logic leads to an uncontrolled resource exhaustion that can hung the application process and render the service unavailable. The vulnerability is classified as a high‑severity Denial of Service.

The issue affects Express.js Multer before version 2.1.1 running on any Node.js environment. All installations that rely on a vulnerable version of this middleware are potentially impacted.

The CVSS score of 8.7 indicates a severe threat. The EPSS score is below 1 %, suggesting that exploitation has not been observed in the wild, and the vulnerability is not listed in CISA’s KEV catalog. An attacker could exploit the flaw remotely by delivering malformed multipart requests over HTTP, assuming the endpoint is exposed to the network. (Based on the description, it is inferred that the attack vector is HTTP.) No active exploits are reported and the attack likely requires sending many crafted packets to trigger the recursion.