### Impact when using the extended query parser in express (`'query parser': 'extended'`), the `request.query` object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names > [!IMPORTANT] > the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser ### Patches the issue has been patched to ensure `request.query` is a plain object so `request.query` no longer has object prototype properties. this brings the default behavior of extended …
GHSA-pj86-cfqh-vqx6: express improperly controls modification of query properties
Express.js versions 4.x improperly controls modification of query properties when using the extended query parser, allowing query string parameters to overwrite object prototype properties.