CVE-2024-51999: express improperly controls modification of query properties

when using the extended query parser in express ('query parser': 'extended'), the request.query object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names

[!IMPORTANT] the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser