{"action":"Upgrade express-param to 1.0.0 or later.","affected":[{"fixed":"1.0.0","introduced":"0"}],"component":"express-param","cve_ids":["CVE-2017-20160"],"ecosystem":"npm","epss":0.00851,"exploited":false,"fixed_versions":["1.0.0"],"ghsa_id":"GHSA-fr54-72wr-cqvq","id":"tcs_01M5KFP44X940G4SGWA6F1AP54","modified_at":"2023-11-08T03:59:17.600913Z","published_at":"2022-12-31T21:30:20Z","references":["https://osv.dev/vulnerability/GHSA-fr54-72wr-cqvq","https://nvd.nist.gov/vuln/detail/CVE-2017-20160","https://github.com/flitto/express-param/pull/19","https://github.com/flitto/express-param/commit/db94f7391ad0a16dcfcba8b9be1af385b25c42db","https://github.com/flitto/express-param","https://github.com/flitto/express-param/releases/tag/1.0.0","https://vuldb.com/?ctiid.217149","https://vuldb.com/?id.217149"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fr54-72wr-cqvq","url":"https://osv.dev/vulnerability/GHSA-fr54-72wr-cqvq"}],"summary":"express-param vulnerable to Improper Handling of Extra Parameters"}