Vulnerabilities

TI-2024-09717 CVE-2024-10491 · GHSA-cm5g-3pgc-8rg4

Preload arbitrary resources by injecting additional `Link` headers

MEDIUM 57

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00441 Published 2024-10-29 Fixed in 4.0.0-rc1 CWE-74

TI-2024-29390 CVE-2024-43796 · GHSA-qw6h-vgh9-j6wx

express vulnerable to XSS via response.redirect()

LOW 23

Express.js minimalist web framework for node.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00486 Published 2024-09-10 Partial fix · 4.20.0, 5.0.0 CWE-79

TI-2024-19223 CVE-2024-29041 · GHSA-rv95-896h-c2vc

Express.js Open Redirect in malformed URLs

LOW 29

Express.js minimalist web framework for node.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00786 Published 2024-03-25 Partial fix · 4.19.0, 5.0.0-beta.3 +1 CWE-1286

TI-2022-08786 CVE-2022-24999 · GHSA-hrpp-h998-j3pp

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers…

HIGH 72

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.15695 Published 2022-11-26 Partial fix · 6.10.3, 6.9.7 +7 CWE-1321

TI-2014-05259 CVE-2014-6393 · GHSA-gpvr-g6gh-9mc2

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a…

LOW 30

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scriptin…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01144 Published 2017-08-09 Partial fix · 3.11.0, 4.5.0 CWE-79