expressjs vulnerabilities

Products

• express 4
• multer 4
• basic-auth-connect 1
• body-parser 1
• method-override 1
• serve-static 1

Latest expressjs CVEs

Newest publication first

1. CVE-2025-7338 Multer vulnerable to Denial of Service via unhandled exception from malformed request

   Published 2025-07-17

   High·CVSS 7.5

   Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request cause...

2. CVE-2025-48997 Multer vulnerable to Denial of Service via unhandled exception

   Published 2025-06-03

   High·CVSS 8.7

   Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. T...

3. CVE-2025-47944 Multer vulnerable to Denial of Service from maliciously crafted requests

   Published 2025-05-19

   High·CVSS 7.5

   Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request cause...

4. CVE-2025-47935 Multer vulnerable to Denial of Service via memory leaks from unclosed streams

   Published 2025-05-19

   High·CVSS 7.5

   Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating...

5. CVE-2024-10491 Preload arbitrary resources by injecting additional `Link` headers

   Published 2024-10-29

   Medium·CVSS 5.3

   A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters l...

6. CVE-2024-9266 Open Redirect

   Published 2024-10-03

   Medium·CVSS 4.7

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.

7. CVE-2024-47178 basic-auth-connect's callback uses time unsafe string comparison

   Published 2024-09-30

   High·CVSS 8.7

   basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.

8. CVE-2024-45590 body-parser vulnerable to denial of service when url encoding is enabled

   Published 2024-09-10

   High·CVSS 7.5

   body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This is...

9. CVE-2024-43800 serve-static affected by template injection that can lead to XSS

   Published 2024-09-10

   Medium·CVSS 4.7

   serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

10. CVE-2024-43796 express vulnerable to XSS via response.redirect()

    Published 2024-09-10

    Medium·CVSS 4.7

    Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

11. CVE-2024-29041 Express.js Open Redirect in malformed URLs

    Published 2024-03-25

    Medium·CVSS 6.1

    Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Expres...

12. CVE-2017-16136 method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header

    Published 2018-06-07

    High·CVSS 7.5

    method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.