CVE-2024-51999
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-01

Last updated on: 2025-12-02

Assigner: GitHub, Inc.

Description
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-01
Last Modified
2025-12-02
Generated
2026-06-16
AI Q&A
2025-12-01
EPSS Evaluated
2025-12-02
NVD
CVE-2024-51999
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
expressjs express 4.22.0
expressjs express 4.0
expressjs express 5.2.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in Express.js versions prior to 5.2.0 and 4.22.0 when using the extended query parser. The request.query object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names. This can lead to unexpected behavior in how query parameters are processed.

Impact Analysis

The vulnerability can cause the request.query object to behave unexpectedly by allowing query string parameters to overwrite inherited prototype properties. This may lead to security issues such as manipulation of application logic or unexpected application behavior, potentially impacting the integrity of request handling.

Mitigation Strategies

Upgrade Express.js to version 5.2.0 or 4.22.0 or later, where this vulnerability is fixed. Additionally, avoid using the 'extended' query parser option in Express.js until the upgrade is applied.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-51999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart