What’s Vulnerable › Vulnerabilities

CVE-2020-7699: Prototype Pollution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-30 · updated 2026-06-17
• Weakness: CWE-1321

Description

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

Affected products

• Express-Fileupload Project Express-Fileupload: before 1.1.8 — fixed in 1.1.8
• NetApp Max Data: all versions

How to fix

Upgrade to a fixed version: Express-Fileupload Project Express-Fileupload 1.1.8. Check the vendor advisory for mitigations.

References

• https://github.com/richardgirges/express-fileupload/issues/236
• https://security.netapp.com/advisory/ntap-20200821-0003/
• https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969
• https://github.com/richardgirges/express-fileupload/issues/236
• https://security.netapp.com/advisory/ntap-20200821-0003/
• https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969

Get alerted when CVE-2020-7699 or the next vulnerability affects your stack