CVE-2024-43800

serve-static affected by template injection that can lead to XSS

5.0 MediumFix available

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.63%Up 0.6 points since Sep 11, 2024

What each source reports

CVE List Score used 5.0

serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: CVE-2024-43800
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2024-2771 5.0

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: EUVD-2024-2771
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cm22-4g7w-348p 2.3

serve-static vulnerable to template injection that can lead to XSS

Impact

passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code

Patches

this issue is patched in serve-static 1.16.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

The attacker MUST control the input to response.redirect()
express MUST NOT redirect before the template appears
the browser MUST NOT complete redirection before:
the user MUST click on the link in the template

Record: GHSA-cm22-4g7w-348p
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.0

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: CVE-2024-43800
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVAZL-49094 4.7

CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-4

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: AZL-49094
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVAZL-49147 4.7

CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: AZL-49147
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Show 8 moreShow less

OSVAZL-49155 4.7

CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-5

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: AZL-49155
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-05

OSV 5.0

serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: CVE-2024-43800
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-43800 4.7

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: DEBIAN-CVE-2024-43800
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-cm22-4g7w-348p 2.3

serve-static vulnerable to template injection that can lead to XSS

Impact

passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code

Patches

this issue is patched in serve-static 1.16.0

Workarounds

Details

successful exploitation of this vector requires the following:

The attacker MUST control the input to response.redirect()
express MUST NOT redirect before the template appears
the browser MUST NOT complete redirection before:
the user MUST click on the link in the template

Record: GHSA-cm22-4g7w-348p
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-43800 5.0

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Record: UBUNTU-CVE-2024-43800
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2026-1784856192 No score

TuxCare security update for serve-static (1 CVE)

TuxCare rebuilt serve-static to address 1 CVE. Fixed in 1.10.3-tuxcare.1.

Record: CLSA-2026-1784856192
Updated: 2026-11-02

OSVCLSA-2026-1792490203 No score

TuxCare security update for serve-static (1 CVE)

TuxCare rebuilt serve-static to address 1 CVE. Fixed in 1.13.2-tuxcare.1.

Record: CLSA-2026-1792490203
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2024-43800 No score

CVE-2024-43800 in @rootio/serve-static - Patched by Root

Root has patched CVE-2024-43800 in the @rootio/serve-static package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-43800
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`serve-static` npm	before 1.16.0	1.16.0
`serve-static` npm	2.0.0 up to 2.1.0	2.1.0
`nodejs-nodemon` Azure Linux:2	through 2.0.3-4	None known
`reaper` Azure Linux:2	before 3.1.1-13	3.1.1-13
`nodejs-nodemon` Azure Linux:3	through 2.0.3-5	None known
`serve-static` TuxCare:npm	1.10.3-tuxcare.0 up to 1.10.3-tuxcare.1, plus listed versions 1.10.3	1.10.3-tuxcare.1
`serve-static` TuxCare:npm	1.13.2-tuxcare.0 up to 1.13.2-tuxcare.1, plus listed versions 1.13.2	1.13.2-tuxcare.1
`node-serve-static` Debian:12	All versions, plus listed versions 1.15.0+~1.15.0-11.15.0+~1.15.7-12.1.0+~1.15.7-12.1.0+~1.15.7-22.2.0+~1.15.9-12.2.0+~2.2.0-12.2.1+~2.2.0-1	None known
`node-serve-static` Debian:13	before 2.1.0+~1.15.7-1	2.1.0+~1.15.7-1
`node-serve-static` Debian:14	before 2.1.0+~1.15.7-1	2.1.0+~1.15.7-1

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`@rootio/serve-static` Root:npm	before 1.15.0-root.io.1	1.15.0-root.io.1
`serve-static` Root:npm	before 1.15.0-aikido.1	1.15.0-aikido.1
`node-serve-static` Ubuntu:16.04:LTS	All versions, plus listed versions 1.6.4-2	None known
`node-serve-static` Ubuntu:18.04:LTS	All versions, plus listed versions 1.6.4-2	None known
`node-serve-static` Ubuntu:20.04:LTS	All versions, plus listed versions 1.6.4-41.14.1-21.14.1-3	None known
`node-serve-static` Ubuntu:22.04:LTS	All versions, plus listed versions 1.14.1-31.14.2+~1.13.10-1	None known
`node-serve-static` Ubuntu:24.04:LTS	All versions, plus listed versions 1.15.0+~1.15.0-11.15.0+~1.15.7-1	None known
`node-serve-static` Ubuntu:25.10	All versions, plus listed versions 2.1.0+~1.15.7-2	None known
`node-serve-static` Ubuntu:26.10	All versions, plus listed versions 2.2.1+~2.2.0-1	None known
`node-serve-static` Ubuntu:26.04:LTS	All versions, plus listed versions 2.1.0+~1.15.7-22.2.0+~1.15.9-12.2.0+~2.2.0-1build12.2.1+~2.2.0-1	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-43800 is a medium vulnerability (CVSS 5.0) in Expressjs Serve-static, published September 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in serve-static 1.16.0.

References

Show 4 moreShow less