# CVE-2020-7699: express-fileupload prototype pollution in nested parsing

Source: https://junglewise.ai/threats/cve-2020-7699-express-fileupload-prototype-pollution-in-nested-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-7699 · Severity: low · CVSS 3.1 · Published 2020-08-05

express-fileupload is a Node.js library that handles file uploads in web applications. When the parseNested option is enabled, a maliciously crafted HTTP upload request can pollute the JavaScript prototype chain, allowing an attacker to execute arbitrary code or crash the server. This affects any web application using this library for file handling.

Technologies: [express-fileupload (npm)](https://junglewise.ai/threats/technologies/express-fileupload). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-7699 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-7699 being exploited in the wild.

**How severe is CVE-2020-7699?** Low severity, with a CVSS score of 3.1, published 5 August 2020.

**Which products and versions are affected?** express-fileupload (npm) SEMVER:introduced=0,fixed=1.1.9.

**Is there a fix for CVE-2020-7699?** Yes. express-fileupload (npm): upgrade to 1.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-7699 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-7699?** Check whether you run express-fileupload (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- express-fileupload (npm): upgrade to 1.1.9 or later

  ```sh
  npm install express-fileupload@1.1.9
  ```


## Technical details

A prototype pollution vulnerability exists in express-fileupload versions before 1.1.9 when the parseNested option is enabled. The vulnerability is triggered by sending a multipart form-data request with specially crafted field names (e.g., "__proto__.toString") that pollute the Object prototype. No authentication is required; the attack is network-accessible via malformed HTTP requests. An attacker can achieve denial of service or arbitrary code execution by injecting properties into the prototype chain. The fix was released in version 1.1.9 (commit db495357d).

## Affected products

- Richard Girges express-fileupload before 1.1.9

## Identifiers

- CVE-2020-7699
- GHSA-9wcg-jrwf-8gg7

## Timeline

- 2020-07-29: disclosed
- 2020-08-03: patched: Fix released in version 1.1.9

## References

- [https://github.com/richardgirges/express-fileupload/issues/236](https://github.com/richardgirges/express-fileupload/issues/236)

## Related threats

- [Express-FileUpload arbitrary file overwrite](https://junglewise.ai/threats/cve-2022-27261-express-fileupload-arbitrary-file-overwrite)
- [express-fileupload denial of service in filename processing](https://junglewise.ai/threats/express-fileupload-denial-of-service-in-filename-processing-efdc3134)