Skip to content

Product

debian/node-express vulnerabilities

4 published CVES affecting debian/node-express, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
0
Medium
3
Low
1
Unscored
0
CISA KEV
0

Latest debian/node-express CVEs

Newest publication first

  1. CVE-2024-29041 Express.js Open Redirect in malformed URLs

    Published
    MediumCVSS 6.1

    Impact Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using enc...

  2. CVE-2014-6393 No Charset in Content-Type Header in express

    Published
    MediumCVSS 6.1 EPSS 1.1%

    The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.

  3. CVE-2024-10491 Express ressource injection

    MediumCVSS 4.0

    A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters l...

  4. CVE-2024-43796 express vulnerable to XSS via response.redirect()

    LowCVSS 2.3

    Impact In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code Patches this issue is patched in express 4.20.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.