GHSA-9wcg-jrwf-8gg7

Prototype Pollution in express-fileupload

At a glance

Published: 2020-08-05 14:53 UTC
Updated: 2026-07-08 06:49 UTC
CVE: CVE-2020-7699
Aliases: SNYK-JS-EXPRESSFILEUPLOAD-595969
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

Affected packages

Package	Versions
npm · express-fileupload	introduced 0, fixed 1.1.9

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7699 ADVISORY
https://github.com/richardgirges/express-fileupload/issues/236 WEB
https://github.com/richardgirges/express-fileupload/pull/237 WEB
https://github.com/richardgirges/express-fileupload/commit/db495357d7557ceb5c034de91a7a574bd12f9b9f WEB
https://github.com/richardgirges/express-fileupload PACKAGE
https://security.netapp.com/advisory/ntap-20200821-0003 WEB
https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database