Preface: A large number of mobile apps and websites allow users to upload profile pictures and other files. Therefore, handling files upload is a common requirement while building a REST API with Node.js & Express (Express-fileupload). Express-fileupload is a middleware.

Technical background: How express-fileupload works? It makes the uploaded files accessible from req[.]files property. For example, if you are uploading a file called my-profile[.]jpg, and your field name is avatar, you can access it via req[.]files[.]avatar.

Vulnerability details: CVE-2020-7699 – This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution. For more details, please refer to attached diagram. Besides, you can find proof of concept details in following link. https://blog.p6.is/Real-World-JS-1/