Description
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| expressjs | express | < 4.20.0, >= 5.0.0-alpha.1, < 5.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-express | 4.21.0+~cs8.36.26-1 | — |
| Debian 13 | node-express | 4.21.0+~cs8.36.26-1 | — |
| Debian 12 | node-express | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | node-express | 4.19.2+~cs8.36.21-1ubuntu0.1~esm1 | USN-7581-1 |
| Ubuntu Pro 22.04 LTS | node-express | 4.17.3+~4.17.13-1ubuntu0.1~esm1 | USN-7581-1 |
| Ubuntu Pro 20.04 LTS | node-express | 4.17.1-2ubuntu0.1~esm1 | USN-7581-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | node-express | 4.1.1~dfsg-1ubuntu0.18.04.1~esm1 | USN-7581-1 |
| Ubuntu Pro 16.04 LTS | node-express | 4.1.1~dfsg-1ubuntu0.16.04.1~esm1 | USN-7581-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs-nodemon | No fix yet | — |
| Azure Linux 3 | python-tensorboard | 2.16.2-5 | — |
| Azure Linux 2 (CBL-Mariner) | nodejs-nodemon | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | reaper | 3.1.1-12 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows | 3.6.5-r2 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.9.0-r4 | — |
| Wolfi rolling | kubeflow-pipelines +11 | 2.2.0-r12 | — |
| Wolfi rolling | sqlpad +1 | 7.5.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | express | < 4.20.0 | 4.20.0 | GHSA-qw6h-vgh9-j6wx |
| npm | express | >= 5.0.0-alpha.1, < 5.0.0 | 5.0.0 | GHSA-qw6h-vgh9-j6wx |
Advisories 10
- WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-7581-1 node-express vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2024-3250 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 8, 2026
- WID-SEC-2024-2197 IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Cross-Site Scripting und Server-Side Request Forgery BSI CERT-Bund (WID) · Jan 25, 2026
- NCSC-2026-0031 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0169 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0824 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0043 IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 17, 2025
- WID-SEC-2024-3344 HCL BigFix WebUI: Mehrere Open Source Schwachstellen BSI CERT-Bund (WID) · Dec 18, 2024