Every CVE Search/ Get API key

CVE-2024-10491

Preload arbitrary resources by injecting additional `Link` headers

4.0 MediumFix available

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.44%Up 0.4 points since Oct 30, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.0

Preload arbitrary resources by injecting additional `Link` headers

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Record
CVE-2024-10491
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2024-3174 4.0

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Record
EUVD-2024-3174
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-cm5g-3pgc-8rg4 4.0

Express ressource injection

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Record
GHSA-cm5g-3pgc-8rg4
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-74
Updated
2026-11-02
NVD 4.0

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Record
CVE-2024-10491
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
OSV 4.0

Preload arbitrary resources by injecting additional `Link` headers

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Record
CVE-2024-10491
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-74
Updated
2026-11-02
OSVDEBIAN-CVE-2024-10491 5.3

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

Record
DEBIAN-CVE-2024-10491
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-cm5g-3pgc-8rg4 4.0

Express ressource injection

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Record
GHSA-cm5g-3pgc-8rg4
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-74
Updated
2026-11-02
OSVCLSA-2026-1773015274 No score

TuxCare security update for express (4 CVEs)

TuxCare rebuilt express to address 4 CVEs. Fixed in 3.21.2-tuxcare.1.

Record
CLSA-2026-1773015274
Updated
2026-11-02
OSVCLSA-2026-1781484856 No score

TuxCare security update for express (3 CVEs)

TuxCare rebuilt express to address 3 CVEs. Fixed in 3.4.8-tuxcare.1.

Record
CLSA-2026-1781484856
Updated
2026-11-05
OSVCLSA-2026-1792597284 No score

TuxCare security update for express (2 CVEs)

TuxCare rebuilt express to address 2 CVEs. Fixed in 3.1.2-tuxcare.2.

Record
CLSA-2026-1792597284
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
express
npm
 through 3.21.4
4.0.0-rc1
express
TuxCare:npm
From an advisory covering 4 CVEs
 3.21.2-tuxcare.0 up to 3.21.2-tuxcare.1, plus listed versions
3.21.2
3.21.2-tuxcare.1
express
TuxCare:npm
From an advisory covering 3 CVEs
 3.4.8-tuxcare.0 up to 3.4.8-tuxcare.1, plus listed versions
3.4.8
3.4.8-tuxcare.1
express
TuxCare:npm
From an advisory covering 2 CVEs
 3.1.2-tuxcare.0 up to 3.1.2-tuxcare.2, plus listed versions
3.1.23.1.2-tuxcare.1
3.1.2-tuxcare.2
node-express
Debian:12
 before 4.1.1~dfsg-1
4.1.1~dfsg-1
node-express
Debian:13
 before 4.1.1~dfsg-1
4.1.1~dfsg-1
node-express
Debian:14
 before 4.1.1~dfsg-1
4.1.1~dfsg-1
express
npm
 before 4.0.0-rc1
4.0.0-rc1

History

History
RecordedChangedSources
affected
factsOSV
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10491 is a medium vulnerability (CVSS 4.0) in @clerk Express, published October 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in express 4.0.0-rc1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open