Read the docs
TI-2024-09717 Aliases CVE-2024-10491GHSA-cm5g-3pgc-8rg4

Preload arbitrary resources by injecting additional `Link` headers

Priority MEDIUM 57CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed express (npm): 4.0.0-rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
expressexpress3.0.0-alpha1 – 3.21.2—No fix listedCNA
—express (npm)before 4.0.0-rc14.0.0-rc1Patch availableGHSA-cm5g-3pgc-8rg4
  • express Vendorexpress Affected 3.0.0-alpha1 – 3.21.2 Fixed in — No fix listed CNA
  • express (npm) Vendor— Affected before 4.0.0-rc1 Fixed in 4.0.0-rc1 Patch available GHSA-cm5g-3pgc-8rg4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:*3.0.0 to before 3.21.5Vulnerablefast-uri
  • cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.21.5 Vulnerable ·fast-uri

Remediation

  • Fix · GHSA-cm5g-3pgc-8rg4 express (npm) Fixed in 4.0.0-rc1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 33 products
  • A-MQ Interconnect 1
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Applications 7
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • Node HealthCheck Operator
  • OpenShift Pipelines
  • OpenShift Service Mesh 2
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 2
  • Red Hat Connectivity Link 1
  • Red Hat Developer Hub 1
  • Red Hat Discovery 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenStack Platform 17.1
  • Red Hat Openshift Container Storage 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Quay 3
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10491
  2. 2026-10-03 Alias added: GHSA-cm5g-3pgc-8rg4
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Advisory 1

Other 2

  • TI-2014-05723 The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not… CVSS 2.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences