CVE-2024-51999

score

<0.1

cvss

—

epss

0.0%

published

2025-12-01

kev added

—

first seen

2026-10-21

Express.js < 5.2.0 and < 4.22.0 contains a prototype pollution vulnerability caused by the extended query parser inheriting all object prototype properties, letting attackers overwrite prototype properties via query string parameters, exploit requires crafted query strings.