Summary
It was discovered that Express incorrectly handled certain URLs, leading
to an open redirect attack. A remote attacker could possibly use this
issue to perform phishing attacks. (CVE-2024-29041)
Adam Korcz discovered that Express did not properly sanitize certain
inputs. A remote attacker could possibly use this issue to perform cross
site scripting. (CVE-2024-43796)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | node-express | 4.1.1~dfsg-1ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | node-express | 4.1.1~dfsg-1ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | node-express | 4.17.1-2ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | node-express | 4.17.3+~4.17.13-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | node-express | 4.19.2+~cs8.36.21-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Medium 6.1
Express.js Open Redirect in malformed URLs
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a use…
-
Medium 5.0
express vulnerable to XSS via response.redirect()
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.