expressjs

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

expressjs records in CISA KEV

No expressjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Multer 9 records MEDIUM Basic-auth-connect 1 record LOW Method-override 1 record LOW

Records

22 records

TI-2024-08602 CVE-2024-9266 · GHSA-jj78-5fmv-mv28

Open redirect in expressjs express

MEDIUM 55

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.0046 Published 2024-10-03 Partial fix · 4.0.0, 4.0.0-rc1 CWE-601

TI-2026-03033 CVE-2026-3520 · GHSA-5528-5vmv-3xc2

Multer vulnerable to Denial of Service via uncontrolled recursion

MEDIUM 45

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00818 Published 2026-03-04 Partial fix · 2.1.1 CWE-674

TI-2026-02853 CVE-2026-3304 · GHSA-xf7r-hgr6-v32p

Multer vulnerable to Denial of Service via incomplete cleanup

MEDIUM 45

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00738 Published 2026-02-27 Partial fix · 2.1.0 CWE-459

TI-2026-01995 CVE-2026-2359 · GHSA-v52c-386h-88mc

Multer vulnerable to Denial of Service via resource exhaustion

MEDIUM 45

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00738 Published 2026-02-27 Partial fix · 2.1.0 CWE-772

TI-2025-31125 CVE-2025-48997 · GHSA-g5hg-p3ph-g8qg

Multer vulnerable to Denial of Service via unhandled exception

MEDIUM 44

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00482 Published 2025-06-03 Partial fix · 2.0.1 CWE-248

TI-2025-30337 CVE-2025-47944 · GHSA-4pg4-qvpc-4q3h

Multer vulnerable to Denial of Service from maliciously crafted requests

MEDIUM 40

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00811 Published 2025-05-19 Fixed in 2.0.0 CWE-248

TI-2025-30328 CVE-2025-47935 · GHSA-44fp-w29j-9vj5

Multer vulnerable to Denial of Service via memory leaks from unclosed streams

MEDIUM 40

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00795 Published 2025-05-19 Fixed in 2.0.0 CWE-401

TI-2025-06690 CVE-2025-7338 · GHSA-fjgf-rc76-4x9p

Multer vulnerable to Denial of Service via unhandled exception from malformed request

MEDIUM 40

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00808 Published 2025-07-17 Partial fix · 2.0.2 CWE-248

TI-2024-30611 CVE-2024-45590 · GHSA-qwcr-r2fm-qrc7

body-parser vulnerable to denial of service when url encoding is enabled

MEDIUM 40

body-parser is Node.js body parsing middleware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00824 Published 2024-09-10 Partial fix · 1.20.3 CWE-405

TI-2026-79290 CVE-2026-113872 · GHSA-q7qp-rjg7-q26m

Process crash in multer after aborted upload with async fileFilter

LOW 39

multer is a middleware for Node.js that handles multipart/form-data file uploads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00442 Published 2026-10-22 Partial fix · 2.5.0 CWE-248

TI-2026-56780 CVE-2026-82333 · GHSA-535w-7cp7-47q4

multer vulnerable to Denial of Service via oversized array index in field names

LOW 39

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00367 Published 2026-08-28 Partial fix · 2.3.0 CWE-400

TI-2026-53831 CVE-2026-77078 · GHSA-wc9g-mqfw-jrwm

multer vulnerable to Denial of Service via crafted multipart field names

LOW 39

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2026-08-28 Partial fix · 2.3.0 CWE-248

TI-2026-53816 CVE-2026-77037 · GHSA-qfvm-cv95-jqjf

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

LOW 39

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00457 Published 2026-08-28 Partial fix · 2.3.0 CWE-400

TI-2026-04434 CVE-2026-5079 · GHSA-72gw-mp4g-v24j

multer vulnerable to Denial of Service via deeply nested field names

LOW 39

Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00279 Published 2026-06-15 Partial fix · 2.2.0, 3.0.0-alpha.2 CWE-400

TI-2026-04396 CVE-2026-5038 · GHSA-3p4h-7m6x-2hcm

multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

LOW 39

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00367 Published 2026-06-15 Partial fix · 2.2.0, 3.0.0-alpha.2 CWE-459

TI-2024-31545 CVE-2024-47178 · GHSA-7p89-p6hx-q4fw

basic-auth-connect's callback uses time unsafe string comparison

LOW 38

basic-auth-connect is Connect's Basic Auth middleware in its own module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00522 Published 2024-09-30 Partial fix · 1.1.0 CWE-208

TI-2017-11855 CVE-2017-16136 · GHSA-qx2f-477c-35rq

Uncontrolled resource consumption in HackerOne method-override node module

LOW 35

method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01196 Published 2018-06-07 Fixed in 2.3.10 CWE-400

TI-2026-60297 CVE-2026-88932 · GHSA-3pph-fpjx-jg34

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

LOW 31

multer is a Node.js middleware for handling multipart/form-data uploads.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00532 Published 2026-09-14 Fixed in 2.4.0 CWE-400

TI-2024-19223 CVE-2024-29041 · GHSA-rv95-896h-c2vc

Express.js Open Redirect in malformed URLs

LOW 29

Express.js minimalist web framework for node.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00786 Published 2024-03-25 Partial fix · 4.19.0, 5.0.0-beta.3 +1 CWE-1286

TI-2024-29394 CVE-2024-43800 · GHSA-cm22-4g7w-348p

serve-static affected by template injection that can lead to XSS

LOW 24

serve-static serves static files.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00631 Published 2024-09-10 Partial fix · 1.16.0, 2.1.0 CWE-79

TI-2024-29390 CVE-2024-43796 · GHSA-qw6h-vgh9-j6wx

express vulnerable to XSS via response.redirect()

LOW 23

Express.js minimalist web framework for node.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00486 Published 2024-09-10 Partial fix · 4.20.0, 5.0.0 CWE-79

TI-2026-53818 CVE-2026-77063 · GHSA-qvfw-j98x-7q72

multer vulnerable to file size limit bypass via async fileFilter race condition

LOW 17

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00233 Published 2026-08-28 Partial fix · 2.3.0 CWE-362

Open these records in search →