GHSA-q7qp-rjg7-q26m multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

• npm multer: >= 2.0.0, < 2.5.0 → fixed in 2.5.0

Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async `fileFilter` is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled `'error'` event, and the process exits. A single unauthenticated request is enough, so any application using `multer` with an asynchronous `fileFilter` is affected, regardless of storage engine. Uploads using a synchronous `fileFilter` are not affected. Patches Users should upgrade to `multer` `2.5.0` or later. Workarounds Use a synchronous `fileFilter`.