express vulnerable to XSS via response.redirect()
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 16 fixed, 28 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix Partial express (expressjs): 4.20.0, 5.0.0express (npm): 4.20.0, 5.0.0Red Hat: 17 advisoriesRed Hat: 16 fixed, 28 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| expressjs | express | before 4.20.0; 5.0.0-alpha.1 to before 5.0.0 | 4.20.0, 5.0.0 | Patch available | CNA |
| — | express (npm) | before 4.20.0 | 4.20.0 | Patch available | GHSA-qw6h-vgh9-j6wx |
| — | express (npm) | 5.0.0-alpha.1 to before 5.0.0 | 5.0.0 | Patch available | GHSA-qw6h-vgh9-j6wx |
- express Vendorexpressjs Affected before 4.20.0; 5.0.0-alpha.1 to before 5.0.0 Fixed in 4.20.0, 5.0.0 Patch available CNA
- express (npm) Vendor— Affected before 4.20.0 Fixed in 4.20.0 Patch available GHSA-qw6h-vgh9-j6wx
- express (npm) Vendor— Affected 5.0.0-alpha.1 to before 5.0.0 Fixed in 5.0.0 Patch available GHSA-qw6h-vgh9-j6wx
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:* | before 4.20.0 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha1:*:*:*:node.js:*:* | 5.0.0 alpha1 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha2:*:*:*:node.js:*:* | 5.0.0 alpha2 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha3:*:*:*:node.js:*:* | 5.0.0 alpha3 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha4:*:*:*:node.js:*:* | 5.0.0 alpha4 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha5:*:*:*:node.js:*:* | 5.0.0 alpha5 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha6:*:*:*:node.js:*:* | 5.0.0 alpha6 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha7:*:*:*:node.js:*:* | 5.0.0 alpha7 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:alpha8:*:*:*:node.js:*:* | 5.0.0 alpha8 | Vulnerable | fast-uri |
| cpe:2.3:a:openjsf:express:5.0.0:beta1:*:*:*:node.js:*:* | 5.0.0 beta1 | Vulnerable | fast-uri |
- cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:* Versions before 4.20.0 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha1:*:*:*:node.js:*:* Versions 5.0.0 alpha1 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha2:*:*:*:node.js:*:* Versions 5.0.0 alpha2 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha3:*:*:*:node.js:*:* Versions 5.0.0 alpha3 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha4:*:*:*:node.js:*:* Versions 5.0.0 alpha4 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha5:*:*:*:node.js:*:* Versions 5.0.0 alpha5 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha6:*:*:*:node.js:*:* Versions 5.0.0 alpha6 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha7:*:*:*:node.js:*:* Versions 5.0.0 alpha7 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:alpha8:*:*:*:node.js:*:* Versions 5.0.0 alpha8 Vulnerable ·fast-uri
- cpe:2.3:a:openjsf:express:5.0.0:beta1:*:*:*:node.js:*:* Versions 5.0.0 beta1 Vulnerable ·fast-uri
Remediation
- Fix · CNA express (expressjs) Fixed in 4.20.0, 5.0.0
- Fix · GHSA-qw6h-vgh9-j6wx express (npm) Fixed in 4.20.0 Advisory →
- Fix · GHSA-qw6h-vgh9-j6wx express (npm) Fixed in 5.0.0 Advisory →
Red Hat 17 advisories
- RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Importantupdated discovery container images
- Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
- RHSA-2025:0875 Released 2025-02-05 · Red Hat rating ImportantOpenShift Container Platform 4.17.15 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9, openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator +2
- RHSA-2025:0323 Released 2025-01-15 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.14.13 Bug Fix Update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
Show 14 more Red Hat advisories
- RHSA-2025:0164 Released 2025-01-09 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.15.9 Bug Fix Update
- RHODF 4.15 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2025:0082 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2025:0079 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.2 Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
- RHSA-2024:11023 Released 2024-12-12 · Red Hat rating ImportantHawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.
- HawtIO 4.0.0 for Red Hat build of Apache Camel 4
- RHSA-2024:10962 Released 2024-12-11 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:10917 Released 2024-12-10 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:10906 Released 2024-12-10 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8 +1
- RHSA-2024:8677 Released 2024-10-30 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.12.6 security update
- Red Hat OpenShift GitOps 1.12 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
- RHSA-2024:8676 Released 2024-10-30 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
- RHSA-2024:8581 Released 2024-10-29 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.13.2 security update
- Red Hat OpenShift GitOps 1.13 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
- RHSA-2024:8014 Released 2024-10-22 · Red Hat rating ImportantNetwork Observability 1.7.0 for OpenShift
- NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:8113 Released 2024-10-15 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.3 security and bug fix update
- RHODF 4.16 for RHEL 9 odf4/mcg-core-rhel9, odf4/odf-console-rhel9
- RHSA-2024:8023 Released 2024-10-14 · Red Hat rating ImportantRelease of OpenShift Serverless Logic 1.34.0 security update & enhancements
- 8Base-Openshift-Serverless-1.34 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 +7
- RHSA-2024:7726 Released 2024-10-07 · Red Hat rating ImportantRed Hat OpenShift Service Mesh Containers for 2.6.2
- RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
- RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| 8Base-Openshift-Serverless-1.34 | Fixed | RHSA-2024:8023 |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:10906 |
| Discovery 1 for RHEL 9 | Fixed | RHSA-2025:1249 |
| HawtIO 4.0.0 for Red Hat build of Apache Camel 4 | Fixed | RHSA-2024:11023 |
| NETOBSERV 1.7 for RHEL 9 | Fixed | RHSA-2024:8014 |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2025:0323 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2025:0164 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:8113, RHSA-2025:0082 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2024:8676, RHSA-2025:0079 |
| RHOSSM 2.6 for RHEL 8 | Fixed | RHSA-2024:7726 |
| RHOSSM 2.6 for RHEL 9 | Fixed | RHSA-2024:7726 |
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2025:0875 |
| Red Hat OpenShift GitOps 1.12 | Fixed | RHSA-2024:8677 |
| Red Hat OpenShift GitOps 1.13 | Fixed | RHSA-2024:8581 |
| Red Hat OpenShift distributed tracing 3.4 | Fixed | RHSA-2024:10917, RHSA-2024:10962 |
Not affected: 27 products
- 8Base-RHMTC-1.8
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- RHODF 4.14 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.3 for RHEL 9
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Data Science (RHODS)
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift distributed tracing 3
- Red Hat OpenShift distributed tracing 3.4
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2024-43796
- 2026-10-03 Alias added: GHSA-qw6h-vgh9-j6wx
- 2026-10-27 Affected versions changed · Red Hat
- 2026-11-05 Affected versions changed · Red Hat
References
More expressjs vulnerabilities
- TI-2024-08602 Open redirect in expressjs express CVSS 3.1MEDIUM 4.7
- TI-2026-03033 Multer vulnerable to Denial of Service via uncontrolled recursion CVSS 4.0HIGH 8.7
- TI-2026-02853 Multer vulnerable to Denial of Service via incomplete cleanup CVSS 4.0HIGH 8.7
- TI-2026-01995 Multer vulnerable to Denial of Service via resource exhaustion CVSS 4.0HIGH 8.7
- TI-2025-31125 Multer vulnerable to Denial of Service via unhandled exception CVSS 4.0HIGH 8.7
- TI-2025-30337 Multer vulnerable to Denial of Service from maliciously crafted requests CVSS 3.1HIGH 7.5
Sources
- CVE-2024-43796 · CVE Program
- CVE-2024-43796 · NVD
- FIRST EPSS
- GHSA-qw6h-vgh9-j6wx · GitHub Advisory Database · CC BY 4.0
- CVE-2024-43796 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences