PT-2020-19722 · Npm · Express-Fileupload

Po6Ix · Published 2020-07-30 · Updated 2026-02-04 · CVE-2020-7699

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions express-fileupload versions prior to 1.1.8

Description The issue allows for denial of service or arbitrary code execution when a corrupt HTTP request is sent and the parseNested option is enabled.

Recommendations For express-fileupload versions prior to 1.1.8, update to version 1.1.8 or later to resolve the issue. As a temporary workaround, consider disabling the parseNested option until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2020-7699

GHSA-9WCG-JRWF-8GG7

SNYK-JS-EXPRESSFILEUPLOAD-595969

Affected Products

Express-Fileupload

References · 10

• 🔥 https://github.com/richardgirges/express-fileupload/issues/236 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969 · Exploit
• https://osv.dev/vulnerability/GHSA-9wcg-jrwf-8gg7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7699 · Security Note
• https://github.com/richardgirges/express-fileupload/commit/db495357d7557ceb5c034de91a7a574bd12f9b9f · Note
• https://github.com/richardgirges/express-fileupload/pull/237 · Note
• https://github.com/richardgirges/express-fileupload · Note
• https://security.netapp.com/advisory/ntap-20200821-0003 · Note
• https://t.me/aptreports/25683 · Telegram Post