Skip to content
OpenAdvisories

Vendor

expressjs

13 known vulnerabilities.

Products

multer 7 express 3 basic-auth-connect 1 serve-static 1 body-parser 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.7
    CVE-2024-9266

    Open Redirect

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.

    expressjs express express npm
  • Medium 5.0
    CVE-2024-43800

    serve-static affected by template injection that can lead to XSS

    serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

    expressjs serve-static serve-static node-serve-static Debian Ubuntu npm
  • Medium 5.0
    CVE-2024-43796

    express vulnerable to XSS via response.redirect()

    Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

    expressjs express express node-express Debian Ubuntu npm
  • Medium 6.1
    CVE-2024-29041

    Express.js Open Redirect in malformed URLs

    Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a use…

    expressjs express express node-express Debian Ubuntu npm