Read the docs
TI-2024-29394 Aliases CVE-2024-43800GHSA-cm22-4g7w-348p

serve-static affected by template injection that can lead to XSS

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 18 fixed, 26 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00631 50th percentileScored 2026-11-07
Fix Partial serve-static (expressjs): 1.16.0, 2.1.0serve-static (npm): 1.16.0, 2.1.0Red Hat: 19 advisoriesRed Hat: 18 fixed, 26 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
expressjsserve-staticbefore 1.16.0; 2.0.0 to before 2.1.01.16.0, 2.1.0Patch availableCNA
—serve-static (npm)before 1.16.01.16.0Patch availableGHSA-cm22-4g7w-348p
—serve-static (npm)2.0.0 to before 2.1.02.1.0Patch availableGHSA-cm22-4g7w-348p
  • serve-static Vendorexpressjs Affected before 1.16.0; 2.0.0 to before 2.1.0 Fixed in 1.16.0, 2.1.0 Patch available CNA
  • serve-static (npm) Vendor— Affected before 1.16.0 Fixed in 1.16.0 Patch available GHSA-cm22-4g7w-348p
  • serve-static (npm) Vendor— Affected 2.0.0 to before 2.1.0 Fixed in 2.1.0 Patch available GHSA-cm22-4g7w-348p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openjsf:serve-static:*:*:*:*:*:node.js:*:*before 1.16.0; 2.0.0 to before 2.1.0Vulnerablefast-uri
  • cpe:2.3:a:openjsf:serve-static:*:*:*:*:*:node.js:*:* Versions before 1.16.0; 2.0.0 to before 2.1.0 Vulnerable ·fast-uri

Remediation

  • Fix · CNA serve-static (expressjs) Fixed in 1.16.0, 2.1.0
  • Fix · GHSA-cm22-4g7w-348p serve-static (npm) Fixed in 1.16.0 Advisory →
  • Fix · GHSA-cm22-4g7w-348p serve-static (npm) Fixed in 2.1.0 Advisory →

Red Hat 19 advisories

  • RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Important
    updated discovery container images
    • Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
  • RHSA-2025:0875 Released 2025-02-05 · Red Hat rating Important
    OpenShift Container Platform 4.17.15 security and extras update
    • Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9, openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator +2
  • RHSA-2025:0323 Released 2025-01-15 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.14.13 Bug Fix Update
    • RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
Show 16 more Red Hat advisories
  • RHSA-2025:0164 Released 2025-01-09 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.15.9 Bug Fix Update
    • RHODF 4.15 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
  • RHSA-2025:0082 Released 2025-01-08 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
    • RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
  • RHSA-2025:0079 Released 2025-01-08 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.2 Bug Fix Update
    • RHODF 4.17 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
  • RHSA-2024:11023 Released 2024-12-12 · Red Hat rating Important
    HawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO 4.0.0 for Red Hat build of Apache Camel 4
  • RHSA-2024:10962 Released 2024-12-11 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
    • Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
  • RHSA-2024:10917 Released 2024-12-10 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
    • Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
  • RHSA-2024:10906 Released 2024-12-10 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
    • 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8 +1
  • RHSA-2024:8677 Released 2024-10-30 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.12.6 security update
    • Red Hat OpenShift GitOps 1.12 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
  • RHSA-2024:8676 Released 2024-10-30 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
    • RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
  • RHSA-2024:8581 Released 2024-10-29 · Red Hat rating Important
    Errata Advisory for Red Hat OpenShift GitOps v1.13.2 security update
    • Red Hat OpenShift GitOps 1.13 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
  • RHSA-2024:8014 Released 2024-10-22 · Red Hat rating Important
    Network Observability 1.7.0 for OpenShift
    • NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
  • RHSA-2024:8113 Released 2024-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.3 security and bug fix update
    • RHODF 4.16 for RHEL 9 odf4/mcg-core-rhel9, odf4/odf-console-rhel9
  • RHSA-2024:8023 Released 2024-10-14 · Red Hat rating Important
    Release of OpenShift Serverless Logic 1.34.0 security update & enhancements
    • 8Base-Openshift-Serverless-1.34 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 +7
  • RHSA-2024:7725 Released 2024-10-07 · Red Hat rating Important
    Red Hat OpenShift Service Mesh Containers for 2.5.5
    • RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
  • RHSA-2024:7726 Released 2024-10-07 · Red Hat rating Important
    Red Hat OpenShift Service Mesh Containers for 2.6.2
    • RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
    • RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
  • RHSA-2024:7724 Released 2024-10-07 · Red Hat rating Important
    Red Hat OpenShift Service Mesh Containers for 2.4.11
    • RHOSSM 2.4 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 3AffectedNo fix yet: Fix deferred
Migration Toolkit for Applications 7AffectedNo fix planned: Will not fix
Migration Toolkit for RuntimesAffectedNo fix planned: Will not fix
Node HealthCheck OperatorAffectedNo fix planned: Will not fix
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 4AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
8Base-Openshift-Serverless-1.34Fixed RHSA-2024:8023
8Base-RHMTC-1.8Fixed RHSA-2024:10906
Discovery 1 for RHEL 9Fixed RHSA-2025:1249
HawtIO 4.0.0 for Red Hat build of Apache Camel 4Fixed RHSA-2024:11023
NETOBSERV 1.7 for RHEL 9Fixed RHSA-2024:8014
RHODF 4.14 for RHEL 9Fixed RHSA-2025:0323
RHODF 4.15 for RHEL 9Fixed RHSA-2025:0164
RHODF 4.16 for RHEL 9Fixed RHSA-2024:8113, RHSA-2025:0082
RHODF 4.17 for RHEL 9Fixed RHSA-2024:8676, RHSA-2025:0079
RHOSSM 2.4 for RHEL 8Fixed RHSA-2024:7724
RHOSSM 2.5 for RHEL 8Fixed RHSA-2024:7725
RHOSSM 2.6 for RHEL 8Fixed RHSA-2024:7726
RHOSSM 2.6 for RHEL 9Fixed RHSA-2024:7726
Red Hat Developer Hub 1.3 for RHEL 9Fixed—
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:0875
Red Hat OpenShift GitOps 1.12Fixed RHSA-2024:8677
Red Hat OpenShift GitOps 1.13Fixed RHSA-2024:8581
Red Hat OpenShift distributed tracing 3.4Fixed RHSA-2024:10917, RHSA-2024:10962
Not affected: 24 products
  • 8Base-RHMTC-1.8
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • RHODF 4.14 for RHEL 9
  • RHODF 4.15 for RHEL 9
  • RHODF 4.16 for RHEL 9
  • RHODF 4.17 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 2
  • Red Hat Developer Hub 1
  • Red Hat Developer Hub 1.3 for RHEL 9
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenShift distributed tracing 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43800
  2. 2026-10-03 Alias added: GHSA-cm22-4g7w-348p
  3. 2026-10-27 EPSS moved to the 50th–90th percentile
  4. 2026-10-27 Affected versions changed · Red Hat
  5. 2026-11-05 Affected versions changed · Red Hat

References

Patch 2

Advisory 2

Other 1

  • TI-2024-08602 Open redirect in expressjs express CVSS 3.1MEDIUM 4.7
  • TI-2026-03033 Multer vulnerable to Denial of Service via uncontrolled recursion CVSS 4.0HIGH 8.7
  • TI-2026-02853 Multer vulnerable to Denial of Service via incomplete cleanup CVSS 4.0HIGH 8.7
  • TI-2026-01995 Multer vulnerable to Denial of Service via resource exhaustion CVSS 4.0HIGH 8.7
  • TI-2025-31125 Multer vulnerable to Denial of Service via unhandled exception CVSS 4.0HIGH 8.7
  • TI-2025-30337 Multer vulnerable to Denial of Service from maliciously crafted requests CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences