A critical vulnerability in the Multer middleware allows unauthenticated remote attackers to trigger a process crash, resulting in a Denial of Service for applications using the library.

The flaw is categorized as an unhandled exception (CWE-248) within the multipart form-data parsing logic. An unauthenticated attacker can send a specifically crafted request that triggers this unhandled exception, causing the entire Node.js process to terminate.

The ability for an unauthenticated attacker to remotely crash a service poses a significant risk to application availability. Given the CVSS score of 7.5, this high-severity vulnerability could lead to service outages, operational disruption, and potential loss of revenue for businesses relying on the affected Node.js infrastructure.

Immediate Action: Update the Multer dependency to version 2.0.2 or later to incorporate the necessary fix for unhandled exceptions.

Proactive Monitoring: Monitor application logs and process management tools for frequent service restarts, which may indicate exploitation attempts targeting this vulnerability.

Compensating Controls: Implement a Web Application Firewall (WAF) or request validation middleware to inspect incoming multipart requests and drop malformed payloads before they reach the Multer parser.

Public Exploit Available: Yes, a public proof-of-concept exists in a GitHub repository linked in the enrichment data.

Due to the ease of exploitation and the potential for complete service disruption, this update should be prioritized in the current maintenance cycle. Organizations using Multer should perform the requested version update immediately to eliminate the risk of process termination via malicious multipart requests.