BaseFortify

Publication date: 2025-12-01

Last updated on: 2025-12-02

Assigner: GitHub, Inc.

Description

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-01

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-12-01

EPSS Evaluated

2025-12-02

NVD

CVE-2024-51999

Affected Vendors & Products

Vendor	Product	Version / Range
expressjs	express	4.22.0
expressjs	express	4.0
expressjs	express	5.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in Express.js versions prior to 5.2.0 and 4.22.0 when using the extended query parser. The request.query object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names. This can lead to unexpected behavior in how query parameters are processed.

Impact Analysis

The vulnerability can cause the request.query object to behave unexpectedly by allowing query string parameters to overwrite inherited prototype properties. This may lead to security issues such as manipulation of application logic or unexpected application behavior, potentially impacting the integrity of request handling.

Mitigation Strategies

Upgrade Express.js to version 5.2.0 or 4.22.0 or later, where this vulnerability is fixed. Additionally, avoid using the 'extended' query parser option in Express.js until the upgrade is applied.

Hi! I’m here to help you understand CVE-2024-51999. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70