--- title: May 2025 Security Releases · Express.js | daily.dev description: Multer, the file upload middleware for Express, has released version 2.0.0 fixing two high-severity vulnerabilities: CVE-2025-47935, a memory leak from... canonical: https://daily.dev/posts/may-2025-security-releases-express-js-uzq22iiav twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: May 2025 Security Releases · Express.js | daily.dev og:description: Multer, the file upload middleware for Express, has released version 2.0.0 fixing two high-severity vulnerabilities: CVE-2025-47935, a memory leak from... og:url: https://daily.dev/posts/may-2025-security-releases-express-js-uzq22iiav og:image: https://api.daily.dev/og/posts/uzQ22IiAv.png og:image:alt: May 2025 Security Releases · Express.js og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # May 2025 Security Releases · Express.js **[Express.js](https://daily.dev/sources/expressjs-blog)** · 2 min read · 0 upvotes · 0 comments ## Summary Multer, the file upload middleware for Express, has released version 2.0.0 fixing two high-severity vulnerabilities: CVE-2025-47935, a memory leak from improper stream handling that can cause denial of service, and CVE-2025-47944, a crash triggered by a malformed multipart request. Versions before 2.0.0 are affected; all users are urged to upgrade immediately. Multer v2.0.0 also raises the minimum supported Node.js version to 10.16.0, a breaking change. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities does Multer 2.0.0 fix? Multer 2.0.0 fixes two high-severity denial of service vulnerabilities: CVE-2025-47935, a memory leak caused by improper stream handling where the internal busboy stream is not closed on HTTP request stream errors, and CVE-2025-47944, an unhandled exception triggered by a malformed multipart request that crashes the server process. Both affect versions before 2.0.0. _Teams patching Express file upload middleware can track advisories like this one on daily.dev._ ### Do I need to upgrade Node.js to use Multer 2.0.0? Yes, Multer 2.0.0 requires Node.js 10.16.0 or later as its new minimum supported version, which is a breaking change from earlier releases. This is bundled alongside fixes for two high-severity denial of service vulnerabilities, so upgrading also means verifying your Node.js runtime meets this minimum. _daily.dev helps developers stay ahead of breaking changes when upgrading dependencies like Multer._ ### Which Multer versions are vulnerable to CVE-2025-47944? Multer versions greater than or equal to 1.4.4-lts.1 and less than 2.0.0 are vulnerable to CVE-2025-47944, a denial of service issue triggered by a specially crafted malformed multipart request that causes an unhandled exception and crashes the server process. The patched version is 2.0.0 or later. _Developers auditing Express dependencies for known CVEs can follow security advisories on daily.dev._ ## Similar posts on daily.dev - [July 2026 Security Releases · Express.js](https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu) · Express.js · 1 upvotes · 1 comments - [August 2026 Security Releases · Express.js](https://daily.dev/posts/august-2026-security-releases-express-js-kdzxqxlti) · Express.js · 2 upvotes · 0 comments - [Node.js — Node.js 26.5.1 \(Current\)](https://daily.dev/posts/node-js-node-js-26-5-1-current--hx951gecs) · Node.js · 25 upvotes · 0 comments - [Best of 2025: CVE-2025-29927 – Understanding the Next.js Middleware Vulnerability](https://daily.dev/posts/best-of-2025-cve-2025-29927-understanding-the-next-js-middleware-vulnerability-fazlvnxc4) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs), [#express](https://daily.dev/tags/express) [View this post on daily.dev](https://daily.dev/posts/may-2025-security-releases-express-js-uzq22iiav) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"May 2025 Security Releases · Express.js","url":"https://daily.dev/posts/may-2025-security-releases-express-js-uzq22iiav","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/may-2025-security-releases-express-js-uzq22iiav"},"datePublished":"2026-08-23T12:17:26.110Z","dateModified":"2026-08-23T12:24:28.843Z","description":"Multer, the file upload middleware for Express, has released version 2.0.0 fixing two high-severity vulnerabilities: CVE-2025-47935, a memory leak from...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cdc94d4a6defd5fbee6a6a0764689f47?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cdc94d4a6defd5fbee6a6a0764689f47?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Express.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Express.js","logo":"https://media.daily.dev/image/upload/s--NvBVN7aT--/f_auto,q_auto/v1787487436/logos/expressjs-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/expressjs-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/may-2025-security-releases-express-js-uzq22iiav","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,nodejs,express","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Express.js","item":"https://daily.dev/sources/expressjs-blog"},{"@type":"ListItem","position":3,"name":"May 2025 Security Releases · Express.js"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/may-2025-security-releases-express-js-uzq22iiav#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities does Multer 2.0.0 fix?","acceptedAnswer":{"@type":"Answer","text":"Multer 2.0.0 fixes two high-severity denial of service vulnerabilities: CVE-2025-47935, a memory leak caused by improper stream handling where the internal busboy stream is not closed on HTTP request stream errors, and CVE-2025-47944, an unhandled exception triggered by a malformed multipart request that crashes the server process. Both affect versions before 2.0.0. Teams patching Express file upload middleware can track advisories like this one on daily.dev."}},{"@type":"Question","name":"Do I need to upgrade Node.js to use Multer 2.0.0?","acceptedAnswer":{"@type":"Answer","text":"Yes, Multer 2.0.0 requires Node.js 10.16.0 or later as its new minimum supported version, which is a breaking change from earlier releases. This is bundled alongside fixes for two high-severity denial of service vulnerabilities, so upgrading also means verifying your Node.js runtime meets this minimum. daily.dev helps developers stay ahead of breaking changes when upgrading dependencies like Multer."}},{"@type":"Question","name":"Which Multer versions are vulnerable to CVE-2025-47944?","acceptedAnswer":{"@type":"Answer","text":"Multer versions greater than or equal to 1.4.4-lts.1 and less than 2.0.0 are vulnerable to CVE-2025-47944, a denial of service issue triggered by a specially crafted malformed multipart request that causes an unhandled exception and crashes the server process. The patched version is 2.0.0 or later. Developers auditing Express dependencies for known CVEs can follow security advisories on daily.dev."}}]} ```