Is CVE-2024-51999 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-51999 being exploited in the wild.

How severe is CVE-2024-51999?

Medium severity, with a CVSS score of 4, published 1 December 2025.

Which products and versions are affected?

Express SEMVER:introduced=0,fixed=4.22.0.

Is there a fix for CVE-2024-51999?

Yes. Express: upgrade to 4.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-51999 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-51999?

Check whether you run Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-51999: Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability.

CVE-2024-51999 · Severity: medium · CVSS 4 · Published 2025-12-01

Express is a widely-used web application framework for Node.js. When using the extended query parser (the default in Express 4), malicious query strings could overwrite inherited object prototype properties on the request.query object. While this advisory has been withdrawn as a correctness bug rather than a security vulnerability, it was addressed in patched versions to align with security best practices.

Technologies: Express.

Quick answers

Is CVE-2024-51999 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-51999 being exploited in the wild.
How severe is CVE-2024-51999?: Medium severity, with a CVSS score of 4, published 1 December 2025.
Which products and versions are affected?: Express SEMVER:introduced=0,fixed=4.22.0.
Is there a fix for CVE-2024-51999?: Yes. Express: upgrade to 4.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-51999 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-51999?: Check whether you run Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Express: upgrade to 4.22.0 or later

Technical details

This issue involves improper control of object attribute modification (CWE-915). When using Express's extended query parser, the request.query object retained inherited properties from the Object prototype, allowing query string parameters with keys matching prototype property names to overwrite these inherited properties. The vulnerability requires network access to the application and no authentication; however, the security impact is minimal. The issue was patched to ensure request.query is a plain object without prototype properties, aligning with Express 5's default behavior. Patches are available in Express 4.22.0 and 5.2.0 (or 5.1.0+ depending on source).

Affected products

Express Express <4.22.0, 5.0.0-<5.2.0

Identifiers

CVE-2024-51999
GHSA-pj86-cfqh-vqx6

Timeline

2025-12-01: disclosed
2025-12-01: patched: Patches released in Express 4.22.0 and 5.2.0
2025-12-02: other: Advisory withdrawn - determined to be a correctness bug, not a security vulnerability

References

https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.

CVE-2024-51999: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability.