CVE-2024-51999 (Medium) detected in express-4.21.2.tgz

[mend-bolt-for-github]

CVE-2024-51999 - Medium Severity Vulnerability

Vulnerable Library - express-4.21.2.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.21.2.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/package.json

Dependency Hierarchy:

• @postgres.ai/shared-4.0.0.tgz (Root Library)
  • react-scripts-5.0.1.tgz
    • webpack-dev-server-4.15.2.tgz
      • ❌ express-4.21.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Impact when using the extended query parser in express ("'query parser': 'extended'"), the "request.query" object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names «[!IMPORTANT] the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser» Patches the issue has been patched to ensure "request.query" is a plain object so "request.query" no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser Workaround this only impacts users using extended query parsing ("'query parser': 'extended'"), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue: provide "qs" directly and specify "plainObjects: true" app.set('query parser', function (str) { return qs.parse(str, { plainObjects: true }); });

Publish Date: 2025-12-01

URL: CVE-2024-51999

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-pj86-cfqh-vqx6

Release Date: 2025-12-01

Fix Resolution: express - 4.22.0,express - 5.2.0

---

Step up your Open Source Security Game with Mend here