CVE-2024-43796
express vulnerable to XSS via response.redirect()
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
express vulnerable to XSS via response.redirect()
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
CVE-2024-43796- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-2859
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
EUVD-2024-2859- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qw6h-vgh9-j6wx
express vulnerable to XSS via response.redirect()
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
- The attacker MUST control the input to response.redirect()
- express MUST NOT redirect before the template appears
- the browser MUST NOT complete redirection before:
- the user MUST click on the link in the template
- Record
GHSA-qw6h-vgh9-j6wx- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
CVE-2024-43796- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVAZL-49053
CVE-2024-43796 affecting package python-tensorboard for versions less than 2.16.2-5
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
AZL-49053- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-05
OSVAZL-49091
CVE-2024-43796 affecting package nodejs-nodemon 2.0.3-4
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
AZL-49091- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 17 moreShow less
OSVAZL-49135
CVE-2024-43796 affecting package reaper for versions less than 3.1.1-12
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
AZL-49135- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVAZL-49152
CVE-2024-43796 affecting package nodejs-nodemon 2.0.3-5
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
AZL-49152- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-05
OSV
express vulnerable to XSS via response.redirect()
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
CVE-2024-43796- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-43796
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
DEBIAN-CVE-2024-43796- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-qw6h-vgh9-j6wx
express vulnerable to XSS via response.redirect()
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
- The attacker MUST control the input to response.redirect()
- express MUST NOT redirect before the template appears
- the browser MUST NOT complete redirection before:
- the user MUST click on the link in the template
- Record
GHSA-qw6h-vgh9-j6wx- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L - CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-43796
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
- Record
UBUNTU-CVE-2024-43796- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773015274 No score
TuxCare security update for express (4 CVEs)
TuxCare rebuilt express to address 4 CVEs. Fixed in 3.21.2-tuxcare.1.
- Record
CLSA-2026-1773015274- Updated
- 2026-11-02
OSVCLSA-2026-1781484856 No score
TuxCare security update for express (3 CVEs)
TuxCare rebuilt express to address 3 CVEs. Fixed in 3.4.8-tuxcare.1.
- Record
CLSA-2026-1781484856- Updated
- 2026-11-05
OSVCLSA-2026-1781484857 No score
TuxCare security update for express (1 CVE)
TuxCare rebuilt express to address 1 CVE. Fixed in 4.19.2-tuxcare.1.
- Record
CLSA-2026-1781484857- Updated
- 2026-11-02
OSVCLSA-2026-1781571273 No score
TuxCare security update for express (2 CVEs)
TuxCare rebuilt express to address 2 CVEs. Fixed in 4.17.1-tuxcare.1.
- Record
CLSA-2026-1781571273- Updated
- 2026-11-02
OSVCLSA-2026-1781571275 No score
TuxCare security update for express (2 CVEs)
TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.1-tuxcare.1.
- Record
CLSA-2026-1781571275- Updated
- 2026-11-02
OSVCLSA-2026-1781571277 No score
TuxCare security update for express (2 CVEs)
TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.2-tuxcare.1.
- Record
CLSA-2026-1781571277- Updated
- 2026-11-02
OSVCLSA-2026-1781571278 No score
TuxCare security update for express (2 CVEs)
TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.3-tuxcare.1.
- Record
CLSA-2026-1781571278- Updated
- 2026-11-02
OSVCLSA-2026-1792473577 No score
TuxCare security update for express (2 CVEs)
TuxCare rebuilt express to address 2 CVEs. Fixed in 3.1.2-tuxcare.1.
- Record
CLSA-2026-1792473577- Updated
- 2026-11-02
OSVCLSA-2026-1792491907 No score
TuxCare security update for express (1 CVE)
TuxCare rebuilt express to address 1 CVE. Fixed in 4.16.3-tuxcare.1.
- Record
CLSA-2026-1792491907- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-43796 No score
CVE-2024-43796 in @rootio/express - Patched by Root
Root has patched CVE-2024-43796 in the @rootio/express package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-43796- Updated
- 2026-11-02
OSVUSN-7581-1 No score
node-express vulnerabilities
It was discovered that Express incorrectly handled certain URLs, leading to an open redirect attack. A remote attacker could possibly use this issue to perform phishing attacks. (CVE-2024-29041)
Adam Korcz discovered that Express did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform cross site scripting. (CVE-2024-43796)
- Record
USN-7581-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
expressnpm |
before 4.20.0 | 4.20.0 |
expressnpm |
5.0.0-alpha.1 up to 5.0.0 | 5.0.0 |
python-tensorboardAzure Linux:3 |
before 2.16.2-5 | 2.16.2-5 |
nodejs-nodemonAzure Linux:2 |
through 2.0.3-4 | None known |
reaperAzure Linux:2 |
before 3.1.1-12 | 3.1.1-12 |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
expressTuxCare:npm From an advisory covering 4 CVEs |
3.21.2-tuxcare.0 up to 3.21.2-tuxcare.1, plus listed versions 3.21.2 |
3.21.2-tuxcare.1 |
expressTuxCare:npm From an advisory covering 3 CVEs |
3.4.8-tuxcare.0 up to 3.4.8-tuxcare.1, plus listed versions 3.4.8 |
3.4.8-tuxcare.1 |
expressTuxCare:npm |
4.19.2-tuxcare.0 up to 4.19.2-tuxcare.1, plus listed versions 4.19.2 |
4.19.2-tuxcare.1 |
expressTuxCare:npm From an advisory covering 2 CVEs |
4.17.1-tuxcare.0 up to 4.17.1-tuxcare.1, plus listed versions 4.17.1 |
4.17.1-tuxcare.1 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
expressTuxCare:npm From an advisory covering 2 CVEs |
4.18.1-tuxcare.0 up to 4.18.1-tuxcare.1, plus listed versions 4.18.1 |
4.18.1-tuxcare.1 |
expressTuxCare:npm From an advisory covering 2 CVEs |
4.18.2-tuxcare.0 up to 4.18.2-tuxcare.1, plus listed versions 4.18.2 |
4.18.2-tuxcare.1 |
expressTuxCare:npm From an advisory covering 2 CVEs |
4.18.3-tuxcare.0 up to 4.18.3-tuxcare.1, plus listed versions 4.18.3 |
4.18.3-tuxcare.1 |
expressTuxCare:npm From an advisory covering 2 CVEs |
3.1.2-tuxcare.0 up to 3.1.2-tuxcare.1, plus listed versions 3.1.2 |
3.1.2-tuxcare.1 |
expressTuxCare:npm |
4.16.3-tuxcare.0 up to 4.16.3-tuxcare.1, plus listed versions 4.16.3 |
4.16.3-tuxcare.1 |
node-expressDebian:12 |
All versions, plus listed versions 4.18.2+~4.17.14-14.18.2+~cs8.34.50-14.19.2+~cs8.36.21-14.19.2+~cs8.36.26-14.21.0+~cs8.36.26-1 Show 6 moreShow less4.21.0+~cs8.36.26-24.21.2+~cs8.36.27-14.21.2+~cs8.36.27-24.21.2+~cs8.36.27-35.1.0+~cs12.3.3-15.2.1+~cs12.3.9-1 |
None known |
node-expressDebian:13 |
before 4.21.0+~cs8.36.26-1 | 4.21.0+~cs8.36.26-1 |
node-expressDebian:14 |
before 4.21.0+~cs8.36.26-1 | 4.21.0+~cs8.36.26-1 |
@rootio/expressRoot:npm |
before 4.18.2-root.io.1 | 4.18.2-root.io.14.18.2-root.io.24.18.2-root.io.3 |
expressRoot:npm |
before 4.18.2-aikido.3 | 4.18.2-aikido.3 |
node-expressUbuntu:Pro:16.04:LTS |
before 4.1.1~dfsg-1ubuntu0.16.04.1~esm1, plus listed versions 4.1.1~dfsg-1 |
4.1.1~dfsg-1ubuntu0.16.04.1~esm1 |
node-expressUbuntu:Pro:18.04:LTS |
before 4.1.1~dfsg-1ubuntu0.18.04.1~esm1, plus listed versions 4.1.1~dfsg-1 |
4.1.1~dfsg-1ubuntu0.18.04.1~esm1 |
node-expressUbuntu:Pro:20.04:LTS |
before 4.17.1-2ubuntu0.1~esm1, plus listed versions 4.17.1-14.17.1-2 |
4.17.1-2ubuntu0.1~esm1 |
node-expressUbuntu:Pro:22.04:LTS |
before 4.17.3+~4.17.13-1ubuntu0.1~esm1, plus listed versions 4.17.1-34.17.1+~cs4.17.13-14.17.2+~4.17.13-14.17.3+~4.17.13-1 |
4.17.3+~4.17.13-1ubuntu0.1~esm1 |
node-expressUbuntu:Pro:24.04:LTS |
before 4.19.2+~cs8.36.21-1ubuntu0.1~esm1, plus listed versions 4.18.2+~cs8.34.50-14.19.2+~cs8.36.21-1 |
4.19.2+~cs8.36.21-1ubuntu0.1~esm1 |
node-expressUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 4.1.1~dfsg-1ubuntu0.16.04.1~esm1, plus listed versions 4.1.1~dfsg-1 |
4.1.1~dfsg-1ubuntu0.16.04.1~esm1 |
node-expressUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 4.1.1~dfsg-1ubuntu0.18.04.1~esm1, plus listed versions 4.1.1~dfsg-1 |
4.1.1~dfsg-1ubuntu0.18.04.1~esm1 |
node-expressUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 4.17.1-2ubuntu0.1~esm1, plus listed versions 4.17.1-14.17.1-2 |
4.17.1-2ubuntu0.1~esm1 |
node-expressUbuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 4.17.3+~4.17.13-1ubuntu0.1~esm1, plus listed versions 4.17.1-34.17.1+~cs4.17.13-14.17.2+~4.17.13-14.17.3+~4.17.13-1 |
4.17.3+~4.17.13-1ubuntu0.1~esm1 |
node-expressUbuntu:Pro:24.04:LTS From an advisory covering 2 CVEs |
before 4.19.2+~cs8.36.21-1ubuntu0.1~esm1, plus listed versions 4.18.2+~cs8.34.50-14.19.2+~cs8.36.21-1 |
4.19.2+~cs8.36.21-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-43796 is a medium vulnerability (CVSS 5.0) in @clerk Express, published September 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in express 4.20.0.
References
github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx
nvd.nist.gov/vuln/detail/CVE-2024-43796
security-tracker.debian.org/tracker/CVE-2024-43796