Expressjs Express vulnerabilities

3 vulnerabilities

Known vulnerabilities in Expressjs Express, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.7CVE-2024-9266expressjsexpress+1
EPSS score
0.46%
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.5CVE-2024-43796chainguardarangodb-3.11+37
EPSS score
0.49%
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.6.1CVE-2024-29041chainguardarangodb-3.11+37
EPSS score
0.79%
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.