qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.
CVSS 3.1MEDIUM 5.3·Network·No auth·No interaction·EPSS 0.00441·Published 2024-10-29·Fixed in 4.0.0-rc1CWE-74
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scriptin…
THREATIST.IORead the docs