p PatchFirst

CVE-2024-10491

CVE-2024-10491 · Preload arbitrary resources by injecting additional `Link` headers

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

CVSS 4.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • express

    Versions
    • ≥ 3.0.0-alpha1, ≤ 3.21.2: Affected (semver)

    No fix published

  • node-express Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.1.1~dfsg-1

    Update to 4.1.1~dfsg-1

  • node-express Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.1.1~dfsg-1

    Update to 4.1.1~dfsg-1

  • node-express Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.1.1~dfsg-1

    Update to 4.1.1~dfsg-1

  • express npm

    Affected ranges
    • SEMVER: < 4.0.0-rc1

    Update to 4.0.0-rc1

Original sources

Check your server →