CVE-2024-51999

Description

## Withdrawn Advisory This advisory has been withdrawn because it describes a correctness bug, not a vulnerability with real security impact. This link is maintained to preserve external references. ## Original Description ### Impact when using the extended query parser in express (`'query parser': 'extended'`), the `request.query` object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names > [!IMPORTANT] > the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser ### Patches the issue has been patched to ensure `request.query` is a plain object so `request.query` no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser ### Workaround this only impacts users using extended query parsing (`'query parser': 'extended'`), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue: #### provide `qs` directly and specify `plainObjects: true` ```js app.set('query parser', function (str) { return qs.parse(str, { plainObjects: true }); }); ```

Affected packages (1)

• npm/expressfrom 0, < 4.22.0

CVSS scores

References (6)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-51999
• PATCHhttps://github.com/expressjs/express
• WEBhttps://github.com/expressjs/express/commit/2f64f68c37c64ae333e41ff38032d21860f22255
• WEBhttps://github.com/expressjs/express/releases/tag/4.22.0
• WEBhttps://github.com/expressjs/express/releases/tag/v5.2.0
• WEBhttps://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6