GHSA-pj86-cfqh-vqx6
NoneCVSS
—
EPSS
—
Published
Dec 1, 2025
CISA due date
—
The record
Withdrawn Advisory: express improperly controls modification of query properties
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | express | 0 | 4.22.0 |
| npm | express | 5.0.0 | 5.2.0 |
| Chainguard | argo-workflow-cli-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-cli-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-controller-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-controller-3.6-compat | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-controller-3.7-compat | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-executor-3.6-compat | 0 | 3.6.13-r2 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflow-executor-3.7-compat | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-known-hosts-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflows-known-hosts-3.7 | 0 | 3.7.4-r1 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.13-r2 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.4-r1 |
| Chainguard | json-server | 0 | 0.17.4-r2 |
| Chainguard | langfuse-3 | 0 | 0 |
| Chainguard | langfuse-3-compat | 0 | 0 |
| Chainguard | langfuse-3-worker | 0 | 0 |
| Chainguard | langfuse-web-3 | 0 | 0 |
| Chainguard | langfuse-web-compat | 0 | 0 |
| Chainguard | langfuse-worker-3 | 0 | 0 |
| Chainguard | librechat | 0 | 0.8.0-r5 |
| Chainguard | librechat-compat | 0 | 0.8.0-r5 |
| Chainguard | librechat-dev | 0 | 0.8.0-r5 |
| Chainguard | opensearch-dashboards-2 | 0 | 0 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-compat | 0 | 0 |
| Chainguard | opensearch-dashboards-2-config | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 0 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-config | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 0 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 0 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 0 |
| Chainguard | redisinsight | 0 | 2.70.1-r5 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 2.70.1-r5 |
| Chainguard | saf | 0 | 1.5.1-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r3 |
| Chainguard | sqlpad-compat | 0 | 7.5.7-r3 |
| Chainguard | thingsboard | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-js-executor | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-mqtt-transport | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-node | 0 | 4.2.1-r8 |
| Chainguard | thingsboard-tb-web-ui | 0 | 4.2.1-r8 |
| Chainguard | tileserver-gl | 0 | 5.4.0-r5 |
| Chainguard | tileserver-gl-compat | 0 | 5.4.0-r5 |
| Chainguard | tileserver-gl-fips | 0 | 0 |
| Chainguard | tileserver-gl-fips-compat | 0 | 0 |
| Wolfi | argo-workflow-cli-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-controller-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-controller-3.7-compat | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-executor-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflow-executor-3.7-compat | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-known-hosts-3.7 | 0 | 3.7.4-r1 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.4-r1 |
| Wolfi | json-server | 0 | 0.17.4-r2 |
| Wolfi | langfuse-3 | 0 | 0 |
| Wolfi | langfuse-3-compat | 0 | 0 |
| Wolfi | langfuse-3-worker | 0 | 0 |
| Wolfi | langfuse-web-3 | 0 | 0 |
| Wolfi | langfuse-web-compat | 0 | 0 |
| Wolfi | langfuse-worker-3 | 0 | 0 |
| Wolfi | opensearch-dashboards-2 | 0 | 0 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-compat | 0 | 0 |
| Wolfi | opensearch-dashboards-2-config | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 0 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 0 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 0 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 0 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 0 |
| Wolfi | saf | 0 | 1.5.1-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r3 |
| Wolfi | sqlpad-compat | 0 | 7.5.7-r3 |
| Wolfi | thingsboard | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-js-executor | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-mqtt-transport | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-node | 0 | 4.2.1-r8 |
| Wolfi | thingsboard-tb-web-ui | 0 | 4.2.1-r8 |
| Wolfi | tileserver-gl | 0 | 5.4.0-r5 |
| Wolfi | tileserver-gl-compat | 0 | 5.4.0-r5 |
Related vulnerabilities
- CVE-2024-51999 Express.js minimalist web framework for node. Same vulnerability
- CVE-2024-10491 A vulnerability has been identified in the Express response.links function, allowing for… Also affects express
- CVE-2024-9266 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. Also affects express
- GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion Also affects argo-workflow-cli-3.6
- CVE-2025-15284 Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue… Also affects argo-workflow-cli-3.6
- CVE-2025-68156 Expr is an expression language and expression evaluation for Go. Also affects argo-workflow-cli-3.6
- GHSA-554w-wpv2-vw27 node-forge has ASN.1 Unbounded Recursion Also affects argo-workflow-cli-3.6
- GHSA-65ch-62r8-g69g node-forge is vulnerable to ASN.1 OID Integer Truncation Also affects argo-workflow-cli-3.6