{"id":"CVE-2024-43796","aliases":["AZL-49053","AZL-49091","AZL-49135","AZL-49152","CLSA-2026-1773015274","CLSA-2026-1781484856","CLSA-2026-1781484857","CLSA-2026-1781571273","CLSA-2026-1781571275","CLSA-2026-1781571277","CLSA-2026-1781571278","CLSA-2026-1792473577","CLSA-2026-1792491907","DEBIAN-CVE-2024-43796","EUVD-2024-2859","GHSA-qw6h-vgh9-j6wx","ROOT-APP-NPM-CVE-2024-43796","UBUNTU-CVE-2024-43796","USN-7581-1"],"status":"published","title":"express vulnerable to XSS via response.redirect()","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00486,"percentile":0.42199,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-09-10T14:36:27Z","modified":"2026-11-05T13:28:23Z","fixes":[{"ecosystem":"npm","package":"express","fixed_in":["4.20.0","5.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-tensorboard","fixed_in":["2.16.2-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-12"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"express","fixed_in":["4.19.2-tuxcare.1","4.16.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-express","fixed_in":["4.21.0+~cs8.36.26-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-express","fixed_in":["4.21.0+~cs8.36.26-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/express","fixed_in":["4.18.2-root.io.1","4.18.2-root.io.2","4.18.2-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"express","fixed_in":["4.18.2-aikido.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-express","fixed_in":["4.1.1~dfsg-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-express","fixed_in":["4.1.1~dfsg-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","fixed_in":["4.17.1-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-express","fixed_in":["4.17.3+~4.17.13-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-express","fixed_in":["4.19.2+~cs8.36.21-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-alpha.1"},{"fixed":"5.0.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.2-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.2-tuxcare.0"},{"fixed":"3.21.2-tuxcare.1"}]}],"versions":["3.21.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.8-tuxcare.0"},{"fixed":"3.4.8-tuxcare.1"}]}],"versions":["3.4.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.19.2-tuxcare.0"},{"fixed":"4.19.2-tuxcare.1"}]}],"versions":["4.19.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.1-tuxcare.0"},{"fixed":"4.17.1-tuxcare.1"}]}],"versions":["4.17.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.1-tuxcare.0"},{"fixed":"4.18.1-tuxcare.1"}]}],"versions":["4.18.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.2-tuxcare.0"},{"fixed":"4.18.2-tuxcare.1"}]}],"versions":["4.18.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.3-tuxcare.0"},{"fixed":"4.18.3-tuxcare.1"}]}],"versions":["4.18.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.1"}]}],"versions":["3.1.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.3-tuxcare.0"},{"fixed":"4.16.3-tuxcare.1"}]}],"versions":["4.16.3"]},{"source":"osv","ecosystem":"Debian:12","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.2+~4.17.14-1","4.18.2+~cs8.34.50-1","4.19.2+~cs8.36.21-1","4.19.2+~cs8.36.26-1","4.21.0+~cs8.36.26-1","4.21.0+~cs8.36.26-2","4.21.2+~cs8.36.27-1","4.21.2+~cs8.36.27-2","4.21.2+~cs8.36.27-3","5.1.0+~cs12.3.3-1","5.2.1+~cs12.3.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.0+~cs8.36.26-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.0+~cs8.36.26-1"}]}]},{"source":"osv","ecosystem":"npm","package":"express","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.20.0"}]}]},{"source":"osv","ecosystem":"npm","package":"express","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0-alpha.1"},{"fixed":"5.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-root.io.1"},{"fixed":"4.18.2-root.io.2"},{"fixed":"4.18.2-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.18.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1-2ubuntu0.1~esm1"}]}],"versions":["4.17.1-1","4.17.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.3+~4.17.13-1ubuntu0.1~esm1"}]}],"versions":["4.17.1-3","4.17.1+~cs4.17.13-1","4.17.2+~4.17.13-1","4.17.3+~4.17.13-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.2+~cs8.36.21-1ubuntu0.1~esm1"}]}],"versions":["4.18.2+~cs8.34.50-1","4.19.2+~cs8.36.21-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1~dfsg-1ubuntu0.18.04.1~esm1"}]}],"versions":["4.1.1~dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1-2ubuntu0.1~esm1"}]}],"versions":["4.17.1-1","4.17.1-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.3+~4.17.13-1ubuntu0.1~esm1"}]}],"versions":["4.17.1-3","4.17.1+~cs4.17.13-1","4.17.2+~4.17.13-1","4.17.3+~4.17.13-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.2+~cs8.36.21-1ubuntu0.1~esm1"}]}],"versions":["4.18.2+~cs8.34.50-1","4.19.2+~cs8.36.21-1"],"bundled":2}],"products":[{"vendor":"@clerk","product":"express"},{"vendor":"expressjs","product":"express"},{"vendor":"openjsf","product":"express"}],"references":[{"url":"https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43796","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qw6h-vgh9-j6wx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43796.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-43796","tags":["advisory"]},{"url":"https://github.com/expressjs/express","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-43796","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-43796","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7581-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-29041","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-43796","title":"express vulnerable to XSS via response.redirect()","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T14:36:27.38Z","modified":"2024-09-10T15:58:45.956Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-2859","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T14:36:27Z","modified":"2024-09-10T15:58:45Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:59.274325Z"}],"ghsa":[{"id":"GHSA-qw6h-vgh9-j6wx","title":"express vulnerable to XSS via response.redirect()","description":"### Impact\n\nIn express \u003c4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in express 4.20.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n","status":"published","published":"2024-09-10T19:41:04Z","modified":"2024-11-18T16:27:12Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"low"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:20.833758Z"}],"nvd":[{"id":"CVE-2024-43796","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T15:15:17.51Z","modified":"2026-06-17T07:51:43.847Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"AZL-49053","title":"CVE-2024-43796 affecting package python-tensorboard for versions less than 2.16.2-5","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"AZL-49091","title":"CVE-2024-43796 affecting package nodejs-nodemon 2.0.3-4","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-04-21T04:29:46.085559Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49135","title":"CVE-2024-43796 affecting package reaper for versions less than 3.1.1-12","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-04-21T04:29:46.695528Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49152","title":"CVE-2024-43796 affecting package nodejs-nodemon 2.0.3-5","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"CVE-2024-43796","title":"express vulnerable to XSS via response.redirect()","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T14:36:27.38Z","modified":"2026-10-28T02:30:39.083286829Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-43796","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T15:15:17.51Z","modified":"2026-11-02T12:02:59.745779287Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"GHSA-qw6h-vgh9-j6wx","title":"express vulnerable to XSS via response.redirect()","description":"### Impact\n\nIn express \u003c4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in express 4.20.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n","status":"published","published":"2024-09-10T19:41:04Z","modified":"2026-09-10T03:50:18.29856294Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"UBUNTU-CVE-2024-43796","description":"Express.js minimalist web framework for node. In express \u003c 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","status":"published","published":"2024-09-10T15:15:00Z","modified":"2026-02-04T03:49:10.096912Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"CLSA-2026-1773015274","title":"TuxCare security update for express (4 CVEs)","description":"TuxCare rebuilt express to address 4 CVEs. Fixed in 3.21.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:42.155476247Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1781484856","title":"TuxCare security update for express (3 CVEs)","description":"TuxCare rebuilt express to address 3 CVEs. Fixed in 3.4.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-11-05T13:28:23.551952568Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1781484857","title":"TuxCare security update for express (1 CVE)","description":"TuxCare rebuilt express to address 1 CVE. Fixed in 4.19.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:50.967128827Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781571273","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.17.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:50.870101528Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781571275","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.252982926Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781571277","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.062305424Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781571278","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:51.058754923Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1792473577","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 3.1.2-tuxcare.1.","status":"published","published":"2026-10-20T05:19:37Z","modified":"2026-10-20T07:15:15.38880426Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792491907","title":"TuxCare security update for express (1 CVE)","description":"TuxCare rebuilt express to address 1 CVE. Fixed in 4.16.3-tuxcare.1.","status":"published","published":"2026-10-20T10:25:07Z","modified":"2026-10-20T13:45:17.972329844Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"ROOT-APP-NPM-CVE-2024-43796","title":"CVE-2024-43796 in @rootio/express - Patched by Root","description":"Root has patched CVE-2024-43796 in the @rootio/express package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:40:47Z","modified":"2026-06-05T01:30:08.789440075Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"USN-7581-1","title":"node-express vulnerabilities","description":"It was discovered that Express incorrectly handled certain URLs, leading\nto an open redirect attack. A remote attacker could possibly use this\nissue to perform phishing attacks. (CVE-2024-29041)\n\nAdam Korcz discovered that Express did not properly sanitize certain\ninputs. A remote attacker could possibly use this issue to perform cross\nsite scripting. (CVE-2024-43796)","status":"published","published":"2025-06-19T04:31:01Z","modified":"2026-06-25T13:32:30.371939528Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}