OpenJS Foundation Express 5.0.0 Alpha 5 for Node.js
Approved changes feed: RSS · Atom
cpe:2.3:a:openjsf:express:5.0.0:alpha5:*:*:*:node.js:*:*
part: a version: 5.0.0 update: alpha5
| Vendor | Openjsf (e371b9eb-ab86-58dc-866f-7af8b12292ef) |
|---|---|
| Product | Express (6237d38e-999e-5748-8dcf-29e89cf0ec1f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/node-express |
purl2cpe | 2026-06-01 10:14:22.103947 |
pkg:deb/ubuntu/node-express |
purl2cpe | 2026-06-01 10:14:22.103948 |
pkg:github/expressjs/express |
purl2cpe | 2026-06-01 10:14:22.103949 |
pkg:maven/org.webjars.npm/express |
purl2cpe | 2026-06-01 10:14:22.103951 |
pkg:npm/express |
purl2cpe | 2026-06-01 10:14:22.103952 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-43796 |
vulnerable | 2026-06-08 06:45:53.057533 |
express vulnerable to XSS via response.redirect()
MEDIUM (5)
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
Published: 2024-09-10T14:36:27.380Z
Updated: 2024-09-10T15:58:45.956Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29041 |
vulnerable | 2026-06-08 06:33:28.481059 |
Express.js Open Redirect in malformed URLs
MEDIUM (6.1)
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
Published: 2024-03-25T20:20:06.205Z
Updated: 2024-08-02T01:03:51.705Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.