{"action":"Upgrade express to 4.19.2 or later.","affected":[{"fixed":"4.19.2","introduced":"0"},{"fixed":"5.0.0-beta.3","introduced":"5.0.0-alpha.1"}],"component":"express","cve_ids":["CVE-2024-29041"],"ecosystem":"npm","epss":0.00786,"exploited":false,"fixed_versions":["4.19.2","5.0.0-beta.3"],"ghsa_id":"GHSA-rv95-896h-c2vc","id":"tcs_01M5KG9Y9N6CR3N2WRDQH7NDZD","modified_at":"2026-09-10T03:50:10.750068508Z","published_at":"2024-03-25T19:40:26Z","references":["https://osv.dev/vulnerability/GHSA-rv95-896h-c2vc","https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","https://nvd.nist.gov/vuln/detail/CVE-2024-29041","https://github.com/koajs/koa/issues/1800","https://github.com/expressjs/express/pull/5539","https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","https://expressjs.com/en/4x/api.html#res.location","https://github.com/expressjs/express"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-rv95-896h-c2vc","url":"https://osv.dev/vulnerability/GHSA-rv95-896h-c2vc"}],"summary":"Express.js Open Redirect in malformed URLs"}