Skip to content

Product

expressjs express vulnerabilities

4 published CVES affecting expressjs express, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
0
Medium
4
Low
0
Unscored
0
CISA KEV
0

Latest expressjs express CVEs

Newest publication first

  1. CVE-2024-10491 Preload arbitrary resources by injecting additional `Link` headers

    Published
    MediumCVSS 5.3 EPSS 0.44%

    A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters l...

  2. CVE-2024-9266 Open Redirect

    Published
    MediumCVSS 4.7 EPSS 0.46%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.

  3. CVE-2024-43796 express vulnerable to XSS via response.redirect()

    Published
    MediumCVSS 4.7 EPSS 0.49%

    Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

  4. CVE-2024-29041 Express.js Open Redirect in malformed URLs

    Published
    MediumCVSS 6.1 EPSS 0.79%

    Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Expres...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.