CVE-2024-29041
1 advisory.
npm/express CVE-2024-29041: medium 6.1, EPSS 0.79%
Express.js Open Redirect in malformed URLs
Action: Upgrade express to 4.19.2 or later.
npm i express@4.19.2npm i express@5.0.0-beta.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.19.2 | - |
| 5.0.0-alpha.1 | 5.0.0-beta.3 | - |
Fixed versions
| 4.19.2 | 5.0.0-beta.3 |
Sources
- osv: GHSA-rv95-896h-c2vc
- https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc
- https://nvd.nist.gov/vuln/detail/CVE-2024-29041
- https://github.com/koajs/koa/issues/1800
- https://github.com/expressjs/express/pull/5539
- https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd
- https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94
- https://expressjs.com/en/4x/api.html#res.location
- https://github.com/expressjs/express
CVE-2024-29041 · published · modified · JSON