{"id":"CVE-2022-23624","aliases":["GHSA-mmj4-777p-fpq9"],"url":"https://o3.security/vulnerability/CVE-2022-23624","summary":"Validation bypass in frourio-express","details":"## 日本語\n\n### 影響\nv0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。\n\n### パッチ\nfrourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。\n\n### ワークアラウンド\ncontroller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。\n\n### さらなる情報\n\nこのセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。\n* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。\n\n## English\n\n### Impact\nFrourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)\n\n### Patches\nPlease update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.\n\n### Workarounds\nValidate objects from request with class-transformer in controllers by yourself, or prevent using validators.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [frourio](https://github.com/frouriojs/frourio)\n","published":"2022-02-07T22:15:10Z","modified":"2026-08-27T03:49:43.836894296Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"frourio-express","fixedVersion":"0.26.0"}],"fix":{"url":"https://github.com/frouriojs/frourio-express/commit/73ded5c6f9f1c126c0cb2d05c0505e9e4db142d2","label":"frouriojs/frourio-express@73ded5c"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23624.json"},{"type":"ADVISORY","url":"https://github.com/frouriojs/frourio-express/security/advisories/GHSA-mmj4-777p-fpq9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23624"},{"type":"FIX","url":"https://github.com/frouriojs/frourio-express/commit/73ded5c6f9f1c126c0cb2d05c0505e9e4db142d2"},{"type":"PACKAGE","url":"https://github.com/frouriojs/frourio-express"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:49:43.836894296Z"}}