Executive brief
Express is a widely-used web application framework for Node.js. When using the extended query parser (the default in Express 4), malicious query strings could overwrite inherited object prototype properties on the request.query object. While this advisory has been withdrawn as a correctness bug rather than a security vulnerability, it was addressed in patched versions to align with security best practices.
Technical details
This issue involves improper control of object attribute modification (CWE-915). When using Express's extended query parser, the request.query object retained inherited properties from the Object prototype, allowing query string parameters with keys matching prototype property names to overwrite these inherited properties. The vulnerability requires network access to the application and no authentication; however, the security impact is minimal. The issue was patched to ensure request.query is a plain object without prototype properties, aligning with Express 5's default behavior. Patches are available in Express 4.22.0 and 5.2.0 (or 5.1.0+ depending on source).
Affected products
- Express Express <4.22.0, 5.0.0-<5.2.0
Timeline
- 2025-12-01: disclosed
- 2025-12-01: patched: Patches released in Express 4.22.0 and 5.2.0
- 2025-12-02: other: Advisory withdrawn - determined to be a correctness bug, not a security vulnerability