Loading story…
A high-severity denial-of-service flaw in the multer npm package allows a single malformed multipart/form-data HTTP POST request to crash vulnerable Node.js applications by triggering an unhandled exception. The issue, tracked as CVE-2025-7338 and GHSA-fjgf-rc76-4x9p, stems from improper handling of Busboy error events in Multer and affects versions >= 1.4.4-lts.1 and < 2.0.2.
The vulnerability impacts common Multer middleware methods including single(), array(), and fields(), putting Express.js applications that rely on file uploads at risk regardless of configuration. Maintainers fixed the bug in Multer 2.0.2 by adding proper error handling so malformed requests no longer terminate the process, and the advisory lists upgrading to 2.0.2 as the recommended remediation with no workaround provided.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub security advisory disclosed a high-severity denial-of-service vulnerability in Multer, warning that malformed requests could crash applications using affected versions. The advisory instructed users to upgrade to version 2.0.2 and noted that no workaround was available.
Multer version 2.0.2 fixed a denial-of-service flaw affecting versions 1.4.4-lts.1 through before 2.0.2, where a malformed multipart/form-data request could trigger an unhandled exception and crash the Node.js process. The fix added proper error handling for Busboy error events.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity denial-of-service vulnerability, tracked as **CVE-2026-66730**, affects **facil.io** versions `0.6.0` through `0.7.6`, including impacted `0.6.x`, `0.7.x`, and `master` code lines. The flaw is in the framework's multipart MIME body parser, where a malformed `multipart/form-data` request containing a partial closing boundary can cause `http_mime_parse` to consume `0` bytes without setting completion or error flags. Because the caller continues parsing the same buffer, an unauthenticated remote attacker can force a worker process into a permanent `100%` CPU loop. The bug is classified as **CWE-835** and **CWE-400** and carries a **CVSS v3.1 score of 7.5** with high availability impact. Exploitation does not crash the server, which means affected workers may remain stuck rather than being automatically respawned; by sending enough crafted requests to match the worker count, an attacker can exhaust all workers and make the service unavailable until it is manually restarted. Public reporting says the issue stems from a missing progress guard in body parsing, and a proposed fix is to add a check in `http_parse_body()` to abort when parsing makes no forward progress.
Jul 28, 2026
Two newly disclosed vulnerabilities affect widely used JavaScript server components, with one enabling **application-level denial of service** in `h3` and the other causing **cross-client data exposure** in `mcp-handler`. The `h3` flaw, tracked as `GHSA-Q5PR-72PQ-83V3`, is an algorithmic complexity issue in chunked cookie processing that lets an attacker send a very small HTTP request and force disproportionate CPU consumption. Rated **CVSS 7.5**, the bug can starve event loops and degrade availability without requiring privileges or user interaction. A separate issue in `mcp-handler`, tracked as `GHSA-W2FM-25VW-VH7F`, stems from a transport race condition that can leak sensitive MCP tool responses across client sessions. The vulnerability, rated **CVSS 7.1**, can expose database query results, local file contents, proprietary data, and raw large language model outputs, while also allowing limited attacker-controlled input injection when misrouted requests are processed in a victim session. The risk is highest in stateless serverless deployments such as **AWS Lambda** or edge runtimes where developers reuse global `McpServer` or `StreamableHTTPServerTransport` instances, while persistent Node.js deployments that create transport objects per connection are described as resistant to this specific flaw.
Jun 29, 2026
A high-severity denial-of-service vulnerability in the Node.js library **Shescape** allows a remote unauthenticated attacker to exhaust CPU resources and halt application processing by sending crafted input to the library's `compose()` function. The flaw, tracked as **`GHSA-gm3r-q2wp-hw87`**, is caused by quadratic-time behavior in the library's default flag-protection logic, where repeated array copying and string joining inside a loop can be abused with repeated null-byte and hyphen sequences to block the single-threaded Node.js event loop. The issue is classified under **`CWE-407`** and **`CWE-400`** and carries a **CVSS v4.0 score of 8.7**. The bug fits the broader **Endpoint Denial of Service** technique documented by MITRE ATT&CK as **`T1499`**, in which attackers degrade or prevent service availability by exhausting host or application resources rather than saturating network bandwidth. In this case, the attack targets the application stack directly, causing total service disruption through algorithmic complexity and CPU exhaustion. Maintainers fixed the issue by replacing the repeated copy-and-join loop with an index-based linear scan, and users are advised to upgrade to **Shescape 2.1.14** or **3.0.1**.
Jul 25, 2026