{"action":"Upgrade express to 4.0.0-rc1 or later.","affected":[{"fixed":"4.0.0-rc1","introduced":"3.4.5"}],"component":"express","cve_ids":["CVE-2024-9266"],"ecosystem":"npm","epss":0.0046,"exploited":false,"fixed_versions":["4.0.0-rc1"],"ghsa_id":"GHSA-jj78-5fmv-mv28","id":"tcs_01M5KFY7XDDWSBCTXVRR549R3V","modified_at":"2024-10-09T23:46:55Z","published_at":"2024-10-03T21:31:05Z","references":["https://osv.dev/vulnerability/GHSA-jj78-5fmv-mv28","https://nvd.nist.gov/vuln/detail/CVE-2024-9266","https://github.com/expressjs/express","https://github.com/expressjs/express/compare/3.4.4...3.4.5","https://www.herodevs.com/vulnerability-directory/cve-2024-9266"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-jj78-5fmv-mv28","url":"https://osv.dev/vulnerability/GHSA-jj78-5fmv-mv28"}],"summary":"Express Open Redirect vulnerability"}