ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2024-51999

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.

Published Dec 1, 2025 · catalog updated Dec 2, 2025 · GitHub_M

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2024-51999. EPSS is 1.00%. Act only if a listed version of GitHub_M is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
1.00%
Remediation
Version ranges on file
Affected products
npm express · vendor GitHub_M

> [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.** > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.** > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.** ## Withdrawn advisory This advisory has been withdrawn because it describes a correctness bug, not a vulnerability with real security impact. This link is maintained to preserve external references. ## Original description ### Impact when using the extended query parser in express ( ), the object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names > [!IMPORTANT] > the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser ### Patches the issue has been patched to ensure is a plain object so no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser ### Workaround this only impacts users using extended query parsing ( ), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue: #### provide directly and specify ### References

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm express<4.22.0
  • npm express<5.1.0
  • vendor GitHub_Mversion unspecified

How to fix CVE-2024-51999

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2024-51999. EPSS is 1.00%. Act only if a listed version of GitHub_M is installed.

Which versions are affected?

Compare what you have installed with <4.22.0, <5.1.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. EPSS 1.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Express.js security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 1, 2025 · EUVD

    Detected

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

  2. Dec 2, 2025 · EUVD

    Updated

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

  3. Dec 2, 2025 · Maintainer security tabs

    Updated

    > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.** > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.** > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been r

Sources

  • CVE.orgVulnerability recordCVE-2024-51999

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2025-200074

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

    euvd.enisa.europa.eu
  • Maintainer security tabsVendor advisoryGHSA-pj86-cfqh-vqx6

    > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.** > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been rejected. The below information is being retained here for posterity.** > [!CAUTION] > **This is not an actual vulnerability and the associated CVE has been r

    github.com

References

Freshness

Last verified in this catalog Dec 2, 2025. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026
  • CVE.orgOct 28, 2026
  • EUVDOct 27, 2026