Vulnerability advisory

CVE-2024-43796

express vulnerable to XSS via response.redirect()

Published Sep 10, 2024Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/expressjs/express ↗
All commits before 21df421ebc7a5249bb31101da666bbf22adc3f18	`21df421ebc7a5249bb31101da666bbf22adc3f18`
Not specified	`54271f69b511fea198471e6ff3400ab805d6b553`
Also listed as affected (191) `4.19.1` `4.19.0` `4.18.3` `4.18.2` `4.18.1` `4.18.0` `4.17.3` `4.17.2` `4.17.1` `4.17.0` `4.16.4` `4.16.3` `4.16.2` `4.16.1` `4.16.0` `4.15.5` `4.15.4` `4.15.3` `4.15.2` `4.15.1` `4.15.0` `4.14.1` `4.14.0` `4.13.4` `4.13.3` `4.13.2` `4.13.1` `4.13.0` `4.12.4` `4.12.3` `4.12.2` `4.12.1` `4.12.0` `4.11.2` `4.11.1` `4.11.0` `4.10.8` `4.10.7` `4.10.6` `4.10.5` `4.10.4` `4.10.3` `4.10.2` `4.10.1` `4.10.0` `4.9.8` `4.9.7` `4.9.6` `4.9.5` `4.9.4` `4.9.3` `4.9.2` `4.9.1` `4.9.0` `4.8.8` `4.8.7` `4.8.6` `4.8.5` `4.8.4` `4.8.3` `4.8.2` `4.8.1` `4.8.0` `4.7.4` `4.7.3` `4.7.2` `4.7.1` `4.7.0` `4.6.1` `4.6.0` `4.5.1` `4.5.0` `4.4.4` `4.4.3` `4.4.2` `4.4.1` `4.4.0` `4.3.2` `4.3.1` `4.3.0` `4.2.0` `4.1.1` `4.1.0` `4.0.0` `4.0.0-rc4` `4.0.0-rc3` `4.0.0-rc2` `4.0.0-rc1` `3.4.7` `3.4.6` `3.4.5` `3.4.4` `3.4.3` `3.4.2` `3.4.0` `3.3.8` `3.3.7` `3.3.6` `3.3.5` `3.3.4` `3.3.3` `3.3.2` `3.3.1` `3.3.0` `3.2.6` `3.2.5` `3.2.4` `3.2.3` `3.2.2` `3.2.1` `3.2.0` `3.1.2` `3.1.1` `3.1.0` `3.0.6` `3.0.5` `3.0.4` `3.0.3` `3.0.2` `3.0.1` `3.0.0rc3` `3.0.0rc2` `3.0.0rc1` `3.0.0beta7` `3.0.0beta6` `3.0.0beta5` `3.0.0beta4` `3.0.0beta3` `3.0.0beta2` `3.0.0beta1` `3.0.0alpha5` `3.0.0alpha4` `3.0.0alpha3` `3.0.0alpha2` `3.0.0alpha1` `2.4.3` `2.4.2` `2.4.1` `2.4.0` `2.3.12` `2.3.11` `2.3.10` `2.3.9` `2.3.8` `2.3.7` `2.3.6` `2.3.5` `2.3.4` `2.3.3` `2.3.2` `2.3.1` `2.3.0` `2.2.2` `2.2.1` `2.2.0` `2.1.1` `2.1.0` `2.0.0` `2.0.0rc3` `2.0.0rc2` `2.0.0rc` `2.0.0beta3` `2.0.0beta2` `1.0.0` `1.0.0rc4` `1.0.0rc3` `1.0.0rc2` `1.0.0rc` `1.0.0beta2` `1.0.0beta` `0.14.0` `0.13.0` `0.12.0` `0.11.0` `0.10.1` `0.10.0` `0.9.0` `0.8.0` `0.7.6` `0.7.5` `0.7.4` `0.7.3` `0.7.2` `0.7.0` `0.6.0` `0.5.0` `0.4.0` `0.3.0` `0.2.1` `0.2.0` `0.1.0`

Description

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVE-2024-43796

Affected versions

Repository

Description

References