CVE-2020-7699

Description

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

References

https://github.com/CQ-Tools/CVE-2020-7699-unfixed

https://github.com/CQ-Tools/CVE-2020-7699-fixed

https://github.com/hemaoqi-Tom/CVE-2020-7699_reproduce

https://github.com/advisories/GHSA-9wcg-jrwf-8gg7

https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969

https://security.netapp.com/advisory/ntap-20200821-0003/

https://github.com/richardgirges/express-fileupload/issues/236

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS