HPP - HTTP Parameter Pollution Protection

JSON →
library 0.2.3 ·javascript maintenance
verified May 27, 2026

`hpp` is an Express middleware designed to protect web applications from HTTP Parameter Pollution (HPP) attacks. HPP exploits how web frameworks handle multiple parameters with the same name in a single request. This library, currently at version 0.2.3, mitigates this by identifying array parameters in `req.query` and `req.body` (specifically for `application/x-www-form-urlencoded` requests) and assigning only the *last* parameter value to the main `req.query` or `req.body` object. The original, potentially polluted array of values is moved to `req.queryPolluted` or `req.bodyPolluted` for inspection. This ensures that downstream middleware or route handlers only receive a single, consistent value for each parameter, preventing attackers from bypassing input validation or causing unexpected application behavior. It's a low-level security utility, likely in maintenance mode given its stable version and specific scope, and integrates directly into the Express middleware chain.

total hits 16
actors 7 distinct systems
last hit 2d ago human
MetaBot
4
GPTBot
2
Script
1
Search engines
2
Humans
2

top countries 🇺🇸 United States · 🇨🇦 Canada · 🇫🇮 Finland · 🇸🇬 Singapore · 🇩🇪 Germany