[Shrinandan-N]

Summary

Fixes Snyk finding SNYK-JS-EXPRESSFILEUPLOAD-595969 / CVE-2020-7699: express-fileupload@0.0.5 (mounted via app.use(fileUpload()) in app.js) is vulnerable to prototype pollution through nested field parsing. This bumps it to 1.5.2 (exact pin, matching the existing style). 1.5.2 defaults parseNested: false and guards nested keys with isSafeFromPollution. I didn't pick the newer 1.6.0 because it was published only two days ago.

Lockfile: express-fileupload now depends only on busboy@^1.6.0. The old transitive deps (connect-busboy, dicer, fs-extra, jsonfile, streamifier) are removed. No other packages changed.

API adaptation in routes/index.js exports.import: on 1.x, req.files.<field> becomes an array when the field is sent more than once. The handler now normalizes that and also handles a missing importFile field, which previously crashed on importFile.data:

var importFile = req.files && req.files.importFile;
if (Array.isArray(importFile)) importFile = importFile[0];
if (!importFile) { res.send('No files were uploaded.'); return; }

importFile.data is still a Buffer on 1.x (the default is useTempFiles: false), so the CSV and ZIP paths are otherwise unchanged. The intentional demo vulnerabilities in this handler (zip-slip, moment ReDoS) are left untouched.

Verification

I ran the app locally (npm start against mongo:3.6) and tested POST /import with curl:

• CSV upload: 302 → /, and the imported todos render on /, including the moment-formatted date (Call mom [2026-11-06])
• ZIP upload: 302, and the archive is extracted to /tmp/extracted_files
• multipart with no file, and a file under the wrong field name: 200 No files were uploaded.
• duplicate importFile field: 302, no crash

PoC on 1.5.2 with fileUpload({ parseNested: true }) and a __proto__.polluted multipart field: ({}).polluted === undefined, so the pollution is blocked.

The repo has no unit tests for this path. npm test is snyk test and needs Snyk auth.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/3d6ca5a4df10434a95165844da817f20
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/3d6ca5a4df10434a95165844da817f20?variant=devin
Requested by: @Shrinandan-N

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	express-fileupload@​0.0.5 ⏵ 1.5.2		+75	+15	+32

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.