PT-2025-48543 · Unknown · Express.Js

Published 2025-12-01 · Updated 2025-12-02 · CVE-2024-51999

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Express.js versions prior to 5.2.0 Express.js versions prior to 4.22.0

Description Express.js, a minimalist web framework for Node.js, is affected by an issue where the request.query object inherits all object prototype properties when using the extended query parser ('query parser': 'extended'). This allows query string parameter keys that match property names to overwrite these properties. The issue is present in versions using the extended query parser.

Recommendations Update to Express.js version 5.2.0 or later. Update to Express.js version 4.22.0 or later.

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2024-51999

GHSA-PJ86-CFQH-VQX6

Affected Products

Express.Js

References · 13

• https://osv.dev/vulnerability/GHSA-pj86-cfqh-vqx6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51999 · Security Note
• https://github.com/expressjs/express/releases/tag/4.22.0 · Note
• https://github.com/expressjs/express/releases/tag/v5.2.0 · Note
• https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6 · Note
• https://github.com/expressjs/express/commit/2f64f68c37c64ae333e41ff38032d21860f22255 · Note
• https://github.com/expressjs/express · Note
• https://t.me/CVEtracker/38579 · Telegram Post
• https://twitter.com/kom_256/status/1995532930697830886 · Twitter Post
• https://twitter.com/CVEnew/status/1995596447752823238 · Twitter Post
• https://twitter.com/kom_256/status/1995532625981964360 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995729942395428944 · Twitter Post