Release: 5.2.1

History.md

@@ -1,3 +1,8 @@
+5.2.1 / 2025-12-01
+=======================
+
+* Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))
+
 5.2.0 / 2025-12-01
 ========================
 

lib/utils.js

@@ -266,6 +266,6 @@ function createETagGenerator (options) {
 
 function parseExtendedQueryString(str) {
   return qs.parse(str, {
-    plainObjects: true
+    allowPrototypes: true
   });
 }

package.json

@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "author": "TJ Holowaychuk <[email protected]>",
   "contributors": [
     "Aaron Heckmann <[email protected]>",

test/req.query.js

@@ -3,7 +3,6 @@
 var assert = require('node:assert')
 var express = require('../')
   , request = require('supertest');
-var qs = require('qs');
 
 describe('req', function(){
   describe('.query', function(){
@@ -39,22 +38,6 @@ describe('req', function(){
         .get('/?user.name=tj')
         .expect(200, '{"user.name":"tj"}', done);
       });
-
-      it('should not be able to access object prototype properties', function (done) {
-        var app = createApp('extended', true);
-
-        request(app)
-        .get('/?foo=yee')
-        .expect(200, /TypeError: req\.query\.hasOwnProperty is not a function/, done);
-      });
-
-      it('should be able to use object prototype property names as keys', function (done) {
-        var app = createApp('extended', true);
-
-        request(app)
-        .get('/?hasOwnProperty=yee')
-        .expect(200, '{"query":{"hasOwnProperty":"yee"},"error":"TypeError: req.query.hasOwnProperty is not a function"}', done);
-      });
     });
 
     describe('when "query parser" is simple', function () {
@@ -65,22 +48,6 @@ describe('req', function(){
         .get('/?user%5Bname%5D=tj')
         .expect(200, '{"user[name]":"tj"}', done);
       });
-
-      it('should not be able to access object prototype properties', function (done) {
-        var app = createApp('simple', true);
-
-        request(app)
-        .get('/?foo=yee')
-        .expect(200, /TypeError: req\.query\.hasOwnProperty is not a function/, done);
-      });
-
-      it('should be able to use object prototype property names as keys', function (done) {
-        var app = createApp('simple', true);
-
-        request(app)
-        .get('/?hasOwnProperty=yee')
-        .expect(200, '{"query":{"hasOwnProperty":"yee"},"error":"TypeError: req.query.hasOwnProperty is not a function"}', done);
-      });
     });
 
     describe('when "query parser" is a function', function () {
@@ -93,18 +60,6 @@ describe('req', function(){
         .get('/?user%5Bname%5D=tj')
         .expect(200, '{"length":17}', done);
       });
-
-      // test exists to verify behavior for folks wishing to workaround our qs defaults
-      it('should drop object prototype property names and be able to access object prototype properties', function (done) {
-        var app = createApp(
-          function (str) {
-            return qs.parse(str)
-          }, true);
-
-        request(app)
-        .get('/?hasOwnProperty=biscuits')
-        .expect(200, '{"query":{},"hasOwnProperty":false}', done);
-      });
     });
 
     describe('when "query parser" disabled', function () {
@@ -115,22 +70,6 @@ describe('req', function(){
         .get('/?user%5Bname%5D=tj')
         .expect(200, '{}', done);
       });
-
-      it('should not be able to access object prototype properties', function (done) {
-        var app = createApp('extended', true);
-
-        request(app)
-        .get('/?foo=yee')
-        .expect(200, /TypeError: req\.query\.hasOwnProperty is not a function/, done);
-      });
-
-      it('should be able to use object prototype property names as keys', function (done) {
-        var app = createApp('extended', true);
-
-        request(app)
-        .get('/?hasOwnProperty=yee')
-        .expect(200, '{"query":{"hasOwnProperty":"yee"},"error":"TypeError: req.query.hasOwnProperty is not a function"}', done);
-      });
     });
 
     describe('when "query parser" enabled', function () {
@@ -141,22 +80,6 @@ describe('req', function(){
         .get('/?user%5Bname%5D=tj')
         .expect(200, '{"user[name]":"tj"}', done);
       });
-
-      it('should not be able to access object prototype properties', function (done) {
-        var app = createApp('extended', true);
-
-        request(app)
-        .get('/?foo=yee')
-        .expect(200, /TypeError: req\.query\.hasOwnProperty is not a function/, done);
-      });
-
-      it('should be able to use object prototype property names as keys', function (done) {
-        var app = createApp('extended', true);
-
-        request(app)
-        .get('/?hasOwnProperty=yee')
-        .expect(200, '{"query":{"hasOwnProperty":"yee"},"error":"TypeError: req.query.hasOwnProperty is not a function"}', done);
-      });
     });
 
     describe('when "query parser" an unknown value', function () {
@@ -168,25 +91,15 @@ describe('req', function(){
   })
 })
 
-function createApp(setting, isPrototypePropertyTest) {
+function createApp(setting) {
   var app = express();
 
   if (setting !== undefined) {
     app.set('query parser', setting);
   }
 
   app.use(function (req, res) {
-    if(isPrototypePropertyTest) {
-      try {
-        var hasOwnProperty = req.query.hasOwnProperty('✨ express ✨');
-        res.send({ query: req.query, hasOwnProperty: hasOwnProperty });
-      } catch (error) {
-        res.send({ query: req.query, error: error.toString() });
-      }
-    }
-    else {
-      res.send(req.query);
-    }
+    res.send(req.query);
   });
 
   return app;