Validation bypass in frourio-express

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

• CVE-2022-23624: 1.24% estimated exploitation activity in the next 30 days; percentile 69.30 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

日本語 影響 v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。 パッチ frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには class-transformer と reflect-metadata の依存への追加も必要となります。 ワークアラウンド controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。 さらなる情報 このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。 frourioにIssueを開く。 English Impact Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through validators/ folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives) Patches Please update your frourio to v0.26.0 or later. You also need to install class-transformer and reflect-metadata to your project. Workarounds Validate objects from request with class-transformer in controllers by yourself, or prevent using validators. For more information If you have any…

Published by the source

7 Feb 2022, 22:38 UTC

Last modified by the source

8 Nov 2023, 04:08 UTC

Source last checked

26 Oct 2026, 12:22 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-mmj4-777p-fpq9

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-mmj4-777p-fpq9

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2022-23624

Advisory: Validation bypass in frourio-express
IDs: CVE-2022-23624, GHSA-mmj4-777p-fpq9
Record: https://patchnext.com/advisories/cve-2022-23624 (revision 2, source checked 26 Oct 2026, 12:22 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: frourio-express 0.26.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm frourio-express: affected < 0.26.0; fixed in 0.26.0

## Suggested inspection (read-only)
- `npm ls frourio-express --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on frourio-express.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-mmj4-777p-fpq9 (OSV record GHSA-mmj4-777p-fpq9 lists affected ranges: npm frourio-express >=0 <0.26.0 (fixed))
- Verified: https://github.com/advisories/GHSA-mmj4-777p-fpq9 (GitHub-reviewed advisory GHSA-mmj4-777p-fpq9 lists affected ranges: npm frourio-express >=0 <0.26.0)

Commands are suggestions: review each one before running it.