{"id":"CVE-2024-29041","aliases":["AZL-37137","AZL-43690","AZL-44361","CLSA-2026-1773015274","CLSA-2026-1781484856","CLSA-2026-1781571273","CLSA-2026-1781571275","CLSA-2026-1781571277","CLSA-2026-1781571278","CLSA-2026-1792597284","CLSA-2026-1792597402","DEBIAN-CVE-2024-29041","EUVD-2024-1007","GHSA-rv95-896h-c2vc","ROOT-APP-NPM-CVE-2024-29041","UBUNTU-CVE-2024-29041","USN-7581-1"],"status":"published","title":"Express.js Open Redirect in malformed URLs","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00786,"percentile":0.56558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1286","CWE-601"],"published":"2024-03-25T19:40:26Z","modified":"2026-11-05T13:28:23Z","fixes":[{"ecosystem":"npm","package":"express","fixed_in":["4.19.2","5.0.0-beta.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-9"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"express","fixed_in":["4.16.3-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-express","fixed_in":["4.19.2+~cs8.36.21-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-express","fixed_in":["4.19.2+~cs8.36.21-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/express","fixed_in":["4.18.2-root.io.2","4.18.2-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"express","fixed_in":["4.18.2-aikido.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-express","fixed_in":["4.1.1~dfsg-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-express","fixed_in":["4.1.1~dfsg-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","fixed_in":["4.17.1-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-express","fixed_in":["4.17.3+~4.17.13-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-alpha.1"},{"fixed":"5.0.0-beta.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.2-tuxcare.0"},{"fixed":"3.21.2-tuxcare.1"}]}],"versions":["3.21.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.8-tuxcare.0"},{"fixed":"3.4.8-tuxcare.1"}]}],"versions":["3.4.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.1-tuxcare.0"},{"fixed":"4.17.1-tuxcare.1"}]}],"versions":["4.17.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.1-tuxcare.0"},{"fixed":"4.18.1-tuxcare.1"}]}],"versions":["4.18.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.2-tuxcare.0"},{"fixed":"4.18.2-tuxcare.1"}]}],"versions":["4.18.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.3-tuxcare.0"},{"fixed":"4.18.3-tuxcare.1"}]}],"versions":["4.18.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.2"}]}],"versions":["3.1.2","3.1.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.3-tuxcare.0"},{"fixed":"4.16.3-tuxcare.2"}]}],"versions":["4.16.3","4.16.3-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.2+~4.17.14-1","4.18.2+~cs8.34.50-1","4.19.2+~cs8.36.21-1","4.19.2+~cs8.36.26-1","4.21.0+~cs8.36.26-1","4.21.0+~cs8.36.26-2","4.21.2+~cs8.36.27-1","4.21.2+~cs8.36.27-2","4.21.2+~cs8.36.27-3","5.1.0+~cs12.3.3-1","5.2.1+~cs12.3.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.2+~cs8.36.21-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.2+~cs8.36.21-1"}]}]},{"source":"osv","ecosystem":"npm","package":"express","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.19.2"}]}]},{"source":"osv","ecosystem":"npm","package":"express","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0-alpha.1"},{"fixed":"5.0.0-beta.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-root.io.2"},{"fixed":"4.18.2-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.18.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1-2ubuntu0.1~esm1"}]}],"versions":["4.17.1-1","4.17.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.3+~4.17.13-1ubuntu0.1~esm1"}]}],"versions":["4.17.1-3","4.17.1+~cs4.17.13-1","4.17.2+~4.17.13-1","4.17.3+~4.17.13-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.18.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1-2ubuntu0.1~esm1"}]}],"versions":["4.17.1-1","4.17.1-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.3+~4.17.13-1ubuntu0.1~esm1"}]}],"versions":["4.17.1-3","4.17.1+~cs4.17.13-1","4.17.2+~4.17.13-1","4.17.3+~4.17.13-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.2+~cs8.36.21-1ubuntu0.1~esm1"}]}],"versions":["4.18.2+~cs8.34.50-1","4.19.2+~cs8.36.21-1"],"bundled":2}],"products":[{"vendor":"@clerk","product":"express"},{"vendor":"expressjs","product":"express"},{"vendor":"openjsf","product":"express"}],"references":[{"url":"https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/koajs/koa/issues/1800","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/expressjs/express/pull/5539","tags":["x_refsource_MISC","x_transferred","Issue Tracking","fix","web","report"]},{"url":"https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://expressjs.com/en/4x/api.html#res.location","tags":["x_refsource_MISC","x_transferred","Technical Description","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29041","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rv95-896h-c2vc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29041.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-29041","tags":["advisory"]},{"url":"https://github.com/expressjs/express","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-29041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29041","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7581-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-43796","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-29041","title":"Express.js Open Redirect in malformed URLs","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T20:20:06.205Z","modified":"2024-08-02T01:03:51.705Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601","CWE-1286"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-1007","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T20:20:06Z","modified":"2024-08-02T01:03:51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:26.166982Z"}],"ghsa":[{"id":"GHSA-rv95-896h-c2vc","title":"Express.js Open Redirect in malformed URLs","description":"### Impact\n\nVersions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.\n\nWhen a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.\n\nThe main method impacted is `res.location()` but this is also called from within `res.redirect()`.\n\n### Patches\n\nhttps://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd\nhttps://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94\n\nAn initial fix went out with `express@4.19.0`, we then patched a feature regression in `4.19.1` and added improved handling for the bypass in `4.19.2`.\n\n### Workarounds\n\nThe fix for this involves pre-parsing the url string with either `require('node:url').parse` or `new URL`. These are steps you can take on your own before passing the user input string to `res.location` or `res.redirect`.\n\n### Resources\n\nhttps://github.com/expressjs/express/pull/5539\nhttps://github.com/koajs/koa/issues/1800\nhttps://expressjs.com/en/4x/api.html#res.location","status":"published","published":"2024-03-25T19:40:26Z","modified":"2025-12-20T00:09:31Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601","CWE-1286"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2024-29041","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T21:15:46.847Z","modified":"2026-06-17T07:22:18.493Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601","CWE-1286"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-29041","title":"Express.js Open Redirect in malformed URLs","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T20:20:06.205Z","modified":"2026-10-28T02:30:43.392891435Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-1286","CWE-601"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-29041","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T21:15:46.847Z","modified":"2026-11-02T12:01:31.420632044Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-rv95-896h-c2vc","title":"Express.js Open Redirect in malformed URLs","description":"### Impact\n\nVersions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.\n\nWhen a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.\n\nThe main method impacted is `res.location()` but this is also called from within `res.redirect()`.\n\n### Patches\n\nhttps://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd\nhttps://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94\n\nAn initial fix went out with `express@4.19.0`, we then patched a feature regression in `4.19.1` and added improved handling for the bypass in `4.19.2`.\n\n### Workarounds\n\nThe fix for this involves pre-parsing the url string with either `require('node:url').parse` or `new URL`. These are steps you can take on your own before passing the user input string to `res.location` or `res.redirect`.\n\n### Resources\n\nhttps://github.com/expressjs/express/pull/5539\nhttps://github.com/koajs/koa/issues/1800\nhttps://expressjs.com/en/4x/api.html#res.location","status":"published","published":"2024-03-25T19:40:26Z","modified":"2026-09-10T03:50:10.750068508Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-1286","CWE-601"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2024-29041","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T21:15:00Z","modified":"2026-02-04T04:13:19.692657Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-37137","title":"CVE-2024-29041 affecting package reaper for versions less than 3.1.1-9","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T21:15:46Z","modified":"2026-04-21T04:28:13.669494Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-43690","title":"CVE-2024-29041 affecting package nodejs-nodemon 2.0.3-4","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T21:15:46Z","modified":"2026-04-21T04:31:06.862044Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44361","title":"CVE-2024-29041 affecting package nodejs-nodemon 2.0.3-5","description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","status":"published","published":"2024-03-25T21:15:46Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CLSA-2026-1773015274","title":"TuxCare security update for express (4 CVEs)","description":"TuxCare rebuilt express to address 4 CVEs. Fixed in 3.21.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:42.155476247Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1781484856","title":"TuxCare security update for express (3 CVEs)","description":"TuxCare rebuilt express to address 3 CVEs. Fixed in 3.4.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-11-05T13:28:23.551952568Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1781571273","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.17.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:50.870101528Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781571275","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.252982926Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781571277","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.062305424Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781571278","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.058754923Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1792597284","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 3.1.2-tuxcare.2.","status":"published","published":"2026-10-21T15:41:24Z","modified":"2026-10-21T20:30:49.855217248Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792597402","title":"TuxCare security update for express (1 CVE)","description":"TuxCare rebuilt express to address 1 CVE. Fixed in 4.16.3-tuxcare.2.","status":"published","published":"2026-10-21T15:43:22Z","modified":"2026-10-21T20:30:49.845349205Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"ROOT-APP-NPM-CVE-2024-29041","title":"CVE-2024-29041 in @rootio/express - Patched by Root","description":"Root has patched CVE-2024-29041 in the @rootio/express package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:40:47Z","modified":"2026-06-05T01:30:27.290938053Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"USN-7581-1","title":"node-express vulnerabilities","description":"It was discovered that Express incorrectly handled certain URLs, leading\nto an open redirect attack. A remote attacker could possibly use this\nissue to perform phishing attacks. (CVE-2024-29041)\n\nAdam Korcz discovered that Express did not properly sanitize certain\ninputs. A remote attacker could possibly use this issue to perform cross\nsite scripting. (CVE-2024-43796)","status":"published","published":"2025-06-19T04:31:01Z","modified":"2026-06-25T13:32:30.371939528Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}