Homepage
About Snyk

express-fileupload@0.4.0 vulnerabilities

Simple express file upload middleware that wraps around Busboy

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the express-fileupload package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Arbitrary File Upload

express-fileupload is a file upload middleware for express that wraps around busboy.

Affected versions of this package are vulnerable to Arbitrary File Upload that allows attackers to execute arbitrary code when uploading a crafted PHP file.

NOTE: The maintainers of this package dispute its validity on the grounds that the attack vector described is the normal usage of the package.

How to fix Arbitrary File Upload?

There is no fixed version for express-fileupload.

*
  • M
Arbitrary File Upload

express-fileupload is a file upload middleware for express that wraps around busboy.

Affected versions of this package are vulnerable to Arbitrary File Upload when it is possible for attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.

How to fix Arbitrary File Upload?

There is no fixed version for express-fileupload.

*
  • H
Prototype Pollution

express-fileupload is a file upload middleware for express that wraps around busboy.

Affected versions of this package are vulnerable to Prototype Pollution. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

How to fix Prototype Pollution?

Upgrade express-fileupload to version 1.1.10 or higher.

<1.1.10
  • H
Denial of Service (DoS)

express-fileupload is a file upload middleware for express that wraps around busboy.

Affected versions of this package are vulnerable to Denial of Service (DoS). The package does not limit file name length.

How to fix Denial of Service (DoS)?

Upgrade express-fileupload to version 1.1.6-alpha.6 or higher.

<1.1.6-alpha.6
Go back to all versions of this package