Fix 4 critical security vulnerabilities in multer by upgrading to v2.0.2

[Copilot]

Overview

This PR addresses 4 security vulnerabilities (1 CRITICAL, 3 HIGH) in the multer package by upgrading from version 1.4.4 to 2.0.2.

Security Vulnerabilities Resolved

1. CVE-2025-7338 (CRITICAL) - Uncaught Exception in makeMiddleware

• CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
• Issue: Application crash when processing file upload requests with field names containing empty strings
• Impact: Denial of Service - attackers can crash the entire Node.js application
• Fixed in: multer 2.0.1+

2. CVE-2025-47944 (HIGH) - Uncaught Exception from busboy

• CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Issue: Unhandled error events thrown by busboy during multipart upload processing
• Impact: Full application crash via specially crafted multipart upload requests
• Fixed in: multer 2.0.0+

3. CVE-2025-47935 (HIGH) - Memory Leak

• CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Issue: Improper handling of error events in HTTP request streams, failing to close internal busboy streams
• Impact: Resource exhaustion and denial of service through repeated error triggers
• Fixed in: multer 2.0.0+

4. Additional Uncaught Exception (HIGH)

• CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Issue: Improper handling of malformed multipart requests
• Impact: Application crash from specially crafted requests
• Fixed in: multer 2.0.2+

Changes Made

• package.json: Updated multer from ^1.4.3 to ^2.0.2
• package-lock.json: Updated to reflect new multer version and dependencies

Testing & Verification

✅ Server starts successfully with multer 2.0.2
✅ File upload functionality works correctly
✅ No breaking changes - API is backward compatible
✅ All 4 security vulnerabilities confirmed resolved
✅ GitHub Advisory Database reports no vulnerabilities in [email protected]

Compatibility Notes

The upgrade from multer 1.x to 2.0.2 requires Node.js 10.16.0 or higher. The current environment is running Node.js 20.19.5, which exceeds this requirement.

The multer 2.x API is backward compatible with the existing code - no changes to server/app.js were required.

References

• GitHub Security Advisory GHSA-fjgf-rc76-4x9p
• GitHub Security Advisory GHSA-g5hg-p3ph-g8qg
• GitHub Security Advisory GHSA-44fp-w29j-9vj5
• GitHub Security Advisory GHSA-4pg4-qvpc-4q3h

Fixes #[issue number]

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Security Vulnerability Scan - 2025-10-15 - 4 vulnerabilities found</issue_title>
<issue_description># Security Vulnerability Analysis Report

Repository: denukedissanayake/ai-bug-fix
Scan Date: 2025-10-15T21:26:00.607Z
Workflow Run: 18543101954
Total Vulnerabilities: 4

Detected Vulnerabilities

Uncaught Exception in [email protected] (HIGH)

Package: [email protected]
CVE ID: SNYK-JS-MULTER-10185673
CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
Fixed In: No direct fix available
Upgradable: true
Patchable: false
Dependency Path: [email protected] → [email protected]

Description: ## Overview

Affected versions of this package are vulnerable to Uncaught Exception due to an error event thrown by busboy. An attacker can cause a full nodejs application to crash by sending a specially crafted multi-part upload request.

PoC

const express = require('express')
const multer  = require('multer')
const http  = require('http')
const upload = multer({ dest: 'uploads/' })
const port = 8888

const app = express()

app.post('/upload', upload.single('file'), function (req, res) {
  res.send({})
})

app.listen(port, () => {
  console.log(`Listening on port ${port}`)

  const boundary = 'AaB03x'
  const body = [
    '--' + boundary,
    'Content-Disposition: form-data; name="file"; filename="test.txt"',
    'Content-Type: text/plain',
    '',
    'test without end boundary'
  ].join('\r\n')
  const options = {
    hostname: 'localhost',
    port,
    path: '/upload',
    method: 'POST',
    headers: {
      'content-type': 'multipart/form-data; boundary=' + boundary,
      'content-length': body.length,
    }
  }
  const req = http.request(options, (res) => {
    console.log(res.statusCode)
  })
  req.on('error', (err) => {
    console.error(err)
  })
  req.write(body)
  req.end()
})

Remediation

Upgrade multer to version 2.0.0 or higher.

References

• GitHub Commit
• GitHub Issue

Fix Command Needed:

npm update multer

---

Missing Release of Memory after Effective Lifetime in [email protected] (HIGH)

Package: [email protected]
CVE ID: SNYK-JS-MULTER-10185675
CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fixed In: No direct fix available
Upgradable: true
Patchable: false
Dependency Path: [email protected] → [email protected]

Description: ## Overview

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper handling of error events in HTTP request streams, which fails to close the internal busboy stream. An attacker can cause a denial of service by repeatedly triggering errors in file upload streams, leading to resource exhaustion and memory leaks.

Note:

This is only exploitable if the server is handling file uploads.

Remediation

Upgrade multer to version 2.0.0 or higher.

References

• GitHub Commit
• GitHub PR

Fix Command Needed:

npm update multer

---

Uncaught Exception in [email protected] (CRITICAL)

Package: [email protected]
CVE ID: SNYK-JS-MULTER-10299078
CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Fixed In: No direct fix available
Upgradable: true
Patchable: false
Dependency Path: [email protected] → [email protected]

Description: ## Overview

Affected versions of this package are vulnerable to Uncaught Exception in makeMiddleware, when processing a file upload request. An attacker can cause the application to crash by sending a request with a field name containing an empty string.

Remediation

Upgrade multer to version 2.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Fix Command Needed:

npm update multer

---

Uncaught Exception in [email protected] (HIGH)

Package: [email protected]
CVE ID: SNYK-JS-MULTER-10773732
CVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fixed In: No direct fix available
Upgradable: true
Patchable: false
Dependency Path: [email protected] → [email protected]

Description: ## Overview

Affected versions of this package are vulnerable to Uncaught Exception due to improper handling of multipart requests. An attacker can cause the application to ...

Fixes #103

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.