From 12ed7c85f31ae88fe7259c69e36029812033e2e8 Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Thu, 5 Jun 2025 14:04:40 +0200 Subject: [PATCH 1/2] blog: add "June 2025 Security Releases" --- _posts/2025-06-05-security-releases.md | 29 ++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 _posts/2025-06-05-security-releases.md diff --git a/_posts/2025-06-05-security-releases.md b/_posts/2025-06-05-security-releases.md new file mode 100644 index 0000000000..e6e4d86033 --- /dev/null +++ b/_posts/2025-06-05-security-releases.md @@ -0,0 +1,29 @@ +--- +title: June 2025 Security Releases +description: Security update for Multer released. All users are encouraged to upgrade. +tags: security vulnerabilities +authors: + - name: Ulises Gascón + github: UlisesGascon +--- + +The Express team has released a new patch version of [Multer](https://www.npmjs.com/package/multer), addressing a high-severity vulnerability that could lead to a Denial of Service (DoS) attack. + +{% include admonitions/warning.html +content="We strongly recommend that all users upgrade to Multer v2.0.1 or later immediately." +%} + +This release addresses the following vulnerability: + +### High severity vulnerability CVE-2025-48997 in Multer middleware + +**[Multer](https://www.npmjs.com/package/multer) versions `>=1.4.4-lts.1` and `<2.0.1` are vulnerable to a Denial of Service (DoS) attack.** + +An attacker can trigger this vulnerability by sending an upload request with an empty string as the field name. This malformed request causes an unhandled exception, leading to a crash of the server process. + +**Affected versions**: `>=1.4.4-lts.1` and `<2.0.1` +**Patched version**: `2.0.1` + +For more details, see [GHSA-g5hg-p3ph-g8qg](https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg). + + From de2ec34ce27ff6524f423cca9aec3674c960bbe9 Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Fri, 18 Jul 2025 10:41:55 +0200 Subject: [PATCH 2/2] docs: update release date --- ...06-05-security-releases.md => 2025-07-18-security-releases.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename _posts/{2025-06-05-security-releases.md => 2025-07-18-security-releases.md} (100%) diff --git a/_posts/2025-06-05-security-releases.md b/_posts/2025-07-18-security-releases.md similarity index 100% rename from _posts/2025-06-05-security-releases.md rename to _posts/2025-07-18-security-releases.md