p PatchFirst

CVE-2024-43796

CVE-2024-43796 · express vulnerable to XSS via response.redirect()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVSS 5.0 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • express

    Versions
    • < 4.20.0: Affected
    • >= 5.0.0-alpha.1, < 5.0.0: Affected

    No fix published

  • node-express Debian:12

    Versions
    • 4.18.2+~4.17.14-1
    • 4.18.2+~cs8.34.50-1
    • 4.19.2+~cs8.36.21-1
    • 4.19.2+~cs8.36.26-1
    • 4.21.0+~cs8.36.26-1
    • 4.21.0+~cs8.36.26-2
    • 4.21.2+~cs8.36.27-1
    • 4.21.2+~cs8.36.27-2
    • 4.21.2+~cs8.36.27-3
    • 5.1.0+~cs12.3.3-1
    • 5.2.1+~cs12.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-express Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.21.0+~cs8.36.26-1

    Update to 4.21.0+~cs8.36.26-1

  • node-express Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.21.0+~cs8.36.26-1

    Update to 4.21.0+~cs8.36.26-1

  • express npm

    Affected ranges
    • SEMVER: < 4.20.0

    Update to 4.20.0

  • express npm

    Affected ranges
    • SEMVER: ≥ 5.0.0-alpha.1, < 5.0.0

    Update to 5.0.0

  • node-express Ubuntu:Pro:16.04:LTS

    Versions
    • 4.1.1~dfsg-1
    Affected ranges
    • ECOSYSTEM: < 4.1.1~dfsg-1ubuntu0.16.04.1~esm1

    Update to 4.1.1~dfsg-1ubuntu0.16.04.1~esm1

  • node-express Ubuntu:Pro:18.04:LTS

    Versions
    • 4.1.1~dfsg-1
    Affected ranges
    • ECOSYSTEM: < 4.1.1~dfsg-1ubuntu0.18.04.1~esm1

    Update to 4.1.1~dfsg-1ubuntu0.18.04.1~esm1

  • node-express Ubuntu:Pro:20.04:LTS

    Versions
    • 4.17.1-1
    • 4.17.1-2
    Affected ranges
    • ECOSYSTEM: < 4.17.1-2ubuntu0.1~esm1

    Update to 4.17.1-2ubuntu0.1~esm1

  • node-express Ubuntu:Pro:22.04:LTS

    Versions
    • 4.17.1-3
    • 4.17.1+~cs4.17.13-1
    • 4.17.2+~4.17.13-1
    • 4.17.3+~4.17.13-1
    Affected ranges
    • ECOSYSTEM: < 4.17.3+~4.17.13-1ubuntu0.1~esm1

    Update to 4.17.3+~4.17.13-1ubuntu0.1~esm1

  • node-express Ubuntu:Pro:24.04:LTS

    Versions
    • 4.18.2+~cs8.34.50-1
    • 4.19.2+~cs8.36.21-1
    Affected ranges
    • ECOSYSTEM: < 4.19.2+~cs8.36.21-1ubuntu0.1~esm1

    Update to 4.19.2+~cs8.36.21-1ubuntu0.1~esm1

Original sources

Check your server →