What is GHSA-q3w9-g74q-vp5f?

GHSA-q3w9-g74q-vp5f is a security advisory published by GitHub Security Advisories with Low severity. Denial of Service in express-fileupload

Why does GHSA-q3w9-g74q-vp5f have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-q3w9-g74q-vp5f?

GHSA-q3w9-g74q-vp5f affects 5 products, including: npm/express-fileupload:\u003c 1.1.6-alpha.6; npm/express-fileupload:\u003c= 1.1.3-alpha.2; npm/express-fileupload:\u003c= 1.1.2-alpha.1; npm/express-fileupload:\u003c= 1.1.1-alpha.3; npm/express-fileupload:\u003c= 1.0.0-alpha.1.

GHSA-q3w9-g74q-vp5fLowDisclosed before NVD

Denial of Service in express-fileupload

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

Versions of express-fileupload prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed (up to 30s in internal testing) if the request contains a large filename of . characters.

Recommendation

Upgrade to version 1.1.6-alpha.6 or later.

🎯 Affected products5

npm/express-fileupload:< 1.1.6-alpha.6
npm/express-fileupload:<= 1.1.3-alpha.2
npm/express-fileupload:<= 1.1.2-alpha.1
npm/express-fileupload:<= 1.1.1-alpha.3
npm/express-fileupload:<= 1.0.0-alpha.1

🔗 References (2)

https://www.npmjs.com/advisories/1216
https://github.com/advisories/GHSA-q3w9-g74q-vp5f