GHSA-9wcg-jrwf-8gg7

Prototype Pollution in express-fileupload

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7699

Packages

Ecosystem	Package	Affected	Fixed in
npm	express-fileupload	< 1.1.9	1.1.9

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7699 advisory
https://github.com/richardgirges/express-fileupload/issues/236 web
https://github.com/richardgirges/express-fileupload/pull/237 web
https://github.com/richardgirges/express-fileupload/commit/db495357d7557ceb5c034de91a7a574bd12f9b9f web
https://github.com/richardgirges/express-fileupload package
https://security.netapp.com/advisory/ntap-20200821-0003 web
https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969 web