Skip to content
fr Sign in
5.0 Medium

CVE-2024-43796 Express.js minimalist web framework for node

Description

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

Affected products and versions

Product Affected versions Fixed in
express 5.0 5.0.0-alpha.1 → < 5.0.0 5.0.0
express 4.20 earliest → < 4.20.0 4.20.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of express

The 4 CVEs of express →
CVE-2024-10491 A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in… 4.0 Medium CVE-2024-9266 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express 4.7 Medium CVE-2024-29041 Express.js minimalist web framework for node 6.1 Medium
Track this CVE