CVE-2024-51999
NoneCVSS
—
EPSS
—
Published
Dec 1, 2025
CISA due date
—
The record
Express.js minimalist web framework for node. Prior to 5.2.0 and 4.22.0, when using the extended query parser in express ('query parser': 'extended'), the request.query object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names. This vulnerability is fixed in 5.2.0 and 4.22.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | express | 0 | 4.22.0 |
| npm | express | 5.0.0 | 5.2.0 |
| Chainguard | argo-workflow-cli-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-cli-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-controller-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-controller-3.6-compat | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-controller-3.7-compat | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-executor-3.6-compat | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-executor-3.7-compat | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-known-hosts-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflows-known-hosts-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.4-r1 |
| Chainguard | json-server | 0 | 0.17.4-r2 |
| Chainguard | langfuse-3 | 0 | 0 |
| Chainguard | langfuse-3-compat | 0 | 0 |
| Chainguard | langfuse-3-worker | 0 | 0 |
| Chainguard | langfuse-web-3 | 0 | 0 |
| Chainguard | langfuse-web-compat | 0 | 0 |
| Chainguard | langfuse-worker-3 | 0 | 0 |
| Chainguard | librechat | 0 | 0.8.0-r5 |
| Chainguard | librechat-compat | 0 | 0.8.0-r5 |
| Chainguard | librechat-dev | 0 | 0.8.0-r5 |
| Chainguard | opensearch-dashboards-2 | 0 | 0 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-compat | 0 | 0 |
| Chainguard | opensearch-dashboards-2-config | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-config | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 0 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 0 |
| Chainguard | redisinsight | 0 | 2.70.1-r5 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 2.70.1-r5 |
| Chainguard | saf | 0 | 1.5.1-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r3 |
| Chainguard | sqlpad-compat | 0 | 7.5.7-r3 |
| Chainguard | thingsboard | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-js-executor | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-mqtt-transport | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-node | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-web-ui | 0 | 4.2.1-r8 |
| Chainguard | tileserver-gl | 0 | 5.4.0-r5 |
| Chainguard | tileserver-gl-compat | 0 | 5.4.0-r5 |
| Chainguard | tileserver-gl-fips | 0 | 0 |
| Chainguard | tileserver-gl-fips-compat | 0 | 0 |
| Wolfi | argo-workflow-cli-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-controller-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-controller-3.7-compat | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-executor-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-executor-3.7-compat | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-known-hosts-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.4-r1 |
| Wolfi | json-server | 0 | 0.17.4-r2 |
| Wolfi | langfuse-3 | 0 | 0 |
| Wolfi | langfuse-3-compat | 0 | 0 |
| Wolfi | langfuse-3-worker | 0 | 0 |
| Wolfi | langfuse-web-3 | 0 | 0 |
| Wolfi | langfuse-web-compat | 0 | 0 |
| Wolfi | langfuse-worker-3 | 0 | 0 |
| Wolfi | opensearch-dashboards-2 | 0 | 0 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-compat | 0 | 0 |
| Wolfi | opensearch-dashboards-2-config | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 0 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 0 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 0 |
| Wolfi | saf | 0 | 1.5.1-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r3 |
| Wolfi | sqlpad-compat | 0 | 7.5.7-r3 |
| Wolfi | thingsboard | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-js-executor | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-mqtt-transport | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-node | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-web-ui | 0 | 4.2.1-r8 |
| Wolfi | tileserver-gl | 0 | 5.4.0-r5 |
| Wolfi | tileserver-gl-compat | 0 | 5.4.0-r5 |
Related vulnerabilities
- GHSA-pj86-cfqh-vqx6 Withdrawn Advisory: express improperly controls modification of query properties Same vulnerability
- CVE-2024-10491 A vulnerability has been identified in the Express response.links function, allowing for… Also affects express
- CVE-2024-9266 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. Also affects express
- GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion Also affects argo-workflow-cli-3.6
- CVE-2025-15284 Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue… Also affects argo-workflow-cli-3.6
- CVE-2025-68156 Expr is an expression language and expression evaluation for Go. Also affects argo-workflow-cli-3.6
- GHSA-554w-wpv2-vw27 node-forge has ASN.1 Unbounded Recursion Also affects argo-workflow-cli-3.6
- GHSA-65ch-62r8-g69g node-forge is vulnerable to ASN.1 OID Integer Truncation Also affects argo-workflow-cli-3.6