[devin-ai-integration]

Summary

Fixes Snyk finding SNYK-JS-EXPRESSFILEUPLOAD-595969 / CVE-2020-7699: prototype pollution in express-fileupload (package.json:28, used by app.use(fileUpload()) in app.js:22). Code scan finding sfind-a35c4dbc7dde4b45aa90c750a942794f.

- "express-fileupload": "0.0.5",
+ "express-fileupload": "1.5.2",

• 1.5.2 is the newest 1.5.x patch (July 2025) and is above the fixed version 1.1.8. 1.6.0 came out on 2026-11-04, so I didn't pick it because it's only two days old. 1.5.2 has the same dependencies (busboy ^1.6.0, node >= 12).
• Lockfile changes: busboy 0.3.1 -> 1.6.0 and streamsearch -> 1.1.0. connect-busboy and dicer are no longer in the tree. Nothing else changed.
• The app doesn't need any code changes. routes.import uses req.files.importFile.data (a Buffer), and with the default useTempFiles: false it is still populated in 1.x. If the request has no file, req.files is still undefined, so the 'No files were uploaded.' branch is unchanged.

Duplicate note: PR #1036 (sfind-70fb9190, 1.5.1) fixes the same CVE. This PR is the separate PR for the new finding ID. Only one of the two should be merged.

Verification

• Real app.js /import flow (in-memory Mongo stand-in, multipart upload with curl). Results were identical before and after: upload returns 302, both imported todos show on /, a request with no file part returns "No files were uploaded.", and a __proto__.polluted field does not pollute Object.prototype.
• CVE PoC with fileUpload({ parseNested: true }), using fields __proto__.polluted and constructor.prototype.polluted2:
  • 1.1.7-alpha.4 (vulnerable): ({}).polluted === "yes", so the prototype was polluted.
  • 1.5.2: the prototype is not polluted. The keys are treated as plain data ({"polluted":"yes","prototype":{...}}).
  • 0.0.5 ignores parseNested, so the PoC doesn't pollute it. Snyk still lists it in the affected range and marks it deprecated ("Please upgrade express-fileupload to version 1.1.8+").
• The repo has no unit tests for this path, and npm test runs snyk test, which needs Snyk auth.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/79c312f58dce458d928daf0c07858cf9
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/79c312f58dce458d928daf0c07858cf9?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	express-fileupload@​0.0.5 ⏵ 1.5.2		+75	+15	+32

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

I tested the Import flow in a browser on this branch (express-fileupload 1.5.2, busboy 1.6.0). The app ran locally against an in-memory Mongo stand-in, not a real database.

• A CSV upload redirected (302) to /, and both imported todos were still there after a reload.
• Submitting with no file chosen returned 200 with No files were uploaded., and the server kept running.
• A benign ZIP upload redirected (302) with no 500. It creates a No backup.txt file found todo, and main (0.0.5) does exactly the same, so this already happens today.

CSV import after reload	Empty upload

main ZIP (0.0.5)	PR ZIP (1.5.2)

I also ran the CVE payload from the shell with parseNested: true. 1.1.7-alpha.4 polluted Object.prototype and 1.5.2 did not. Not tested: real MongoDB persistence.

Written by Devin