{"id":"CVE-2024-43799","aliases":["AZL-49088","AZL-49123","AZL-49164","CLSA-2026-1791841547","CLSA-2026-1791843631","CLSA-2026-1791850713","CLSA-2026-1792477991","CLSA-2026-1792490955","CLSA-2026-1792496437","CLSA-2026-1793098701","CLSA-2026-1793291196","CLSA-2026-1793292510","DEBIAN-CVE-2024-43799","DLA-4224-1","EUVD-2024-2831","GHSA-m6fv-jmcg-4jfg","ROOT-APP-NPM-CVE-2024-43799","UBUNTU-CVE-2024-43799"],"status":"published","title":"send vulnerable to template injection that can lead to XSS","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00541,"percentile":0.45806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-09-10T14:45:06Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"send","fixed_in":["0.19.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-13"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"send","fixed_in":["0.18.0-tuxcare.1","0.17.2-tuxcare.1","0.16.1-tuxcare.1","0.16.2-tuxcare.1","0.17.1-tuxcare.1","0.13.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-send","fixed_in":["0.18.0+~cs1.19.1-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-send","fixed_in":["1.1.0+~cs1.19.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-send","fixed_in":["1.1.0+~cs1.19.4-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"node-send","fixed_in":["0.17.1-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/send","fixed_in":["0.18.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"send","fixed_in":["0.18.0-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0-tuxcare.0"},{"fixed":"0.18.0-tuxcare.1"}]}],"versions":["0.18.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.17.2-tuxcare.0"},{"fixed":"0.17.2-tuxcare.1"}]}],"versions":["0.17.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.1-tuxcare.0"},{"fixed":"0.16.1-tuxcare.1"}]}],"versions":["0.16.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.2-tuxcare.0"},{"fixed":"0.16.2-tuxcare.1"}]}],"versions":["0.16.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.4-tuxcare.0"},{"fixed":"0.7.4-tuxcare.1"}]}],"versions":["0.7.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.17.1-tuxcare.0"},{"fixed":"0.17.1-tuxcare.1"}]}],"versions":["0.17.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.0-tuxcare.0"},{"fixed":"0.13.0-tuxcare.1"}]}],"versions":["0.13.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.4-tuxcare.0"},{"fixed":"0.1.4-tuxcare.1"}]}],"versions":["0.1.4"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0+~cs1.19.1-3+deb12u1"}]}],"versions":["0.18.0+~cs1.19.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+~cs1.19.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+~cs1.19.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.1-2+deb11u1"}]}],"versions":["0.17.1-2"]},{"source":"osv","ecosystem":"npm","package":"send","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.2-1","0.17.1-1","0.17.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.1-2","0.17.1-3","0.17.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-send","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.0+~cs1.19.1-3"]}],"products":[{"vendor":"pillarjs","product":"send"},{"vendor":"send_project","product":"send"}],"references":[{"url":"https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43799","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m6fv-jmcg-4jfg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43799.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-43799","tags":["advisory"]},{"url":"https://github.com/pillarjs/send","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-43799","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-43799","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-43799","title":"send vulnerable to template injection that can lead to XSS","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T14:45:06.761Z","modified":"2025-11-03T19:30:41.76Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-2831","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T14:45:06Z","modified":"2025-11-03T19:30:41Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-m6fv-jmcg-4jfg","title":"send vulnerable to template injection that can lead to XSS","description":"### Impact\n\npassing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in send 0.19.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template","status":"published","published":"2024-09-10T19:42:41Z","modified":"2025-11-03T22:48:05Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"low"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2024-43799","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T15:15:17.727Z","modified":"2026-06-17T07:51:44.173Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"AZL-49088","title":"CVE-2024-43799 affecting package nodejs-nodemon 2.0.3-4","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-04-21T04:29:45.505765Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49123","title":"CVE-2024-43799 affecting package reaper for versions less than 3.1.1-13","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-04-21T04:29:46.829701Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49164","title":"CVE-2024-43799 affecting package nodejs-nodemon 2.0.3-5","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"CVE-2024-43799","title":"send vulnerable to template injection that can lead to XSS","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T14:45:06.761Z","modified":"2026-10-28T02:31:08.473829581Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-43799","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T15:15:17.727Z","modified":"2026-11-02T12:02:59.988058359Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"GHSA-m6fv-jmcg-4jfg","title":"send vulnerable to template injection that can lead to XSS","description":"### Impact\n\npassing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in send 0.19.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template","status":"published","published":"2024-09-10T19:42:41Z","modified":"2026-09-10T03:50:18.939403414Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"UBUNTU-CVE-2024-43799","description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","status":"published","published":"2024-09-10T15:15:00Z","modified":"2025-10-24T05:11:48Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"CLSA-2026-1791841547","title":"TuxCare security update for send (1 CVE)","description":"TuxCare rebuilt send to address 1 CVE. Fixed in 0.18.0-tuxcare.1.","status":"published","published":"2026-10-12T21:45:47Z","modified":"2026-10-15T09:45:52.233808445Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791843631","title":"TuxCare security update for send (3 CVEs)","description":"TuxCare rebuilt send to address 3 CVEs. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-10-12T22:20:31Z","modified":"2026-10-15T09:47:47.855235034Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791850713","title":"TuxCare security update for send (1 CVE)","description":"TuxCare rebuilt send to address 1 CVE. Fixed in 0.17.2-tuxcare.1.","status":"published","published":"2026-10-13T00:18:33Z","modified":"2026-10-15T09:47:53.553868136Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792477991","title":"TuxCare security update for send (1 CVE)","description":"TuxCare rebuilt send to address 1 CVE. Fixed in 0.16.1-tuxcare.1.","status":"published","published":"2026-10-20T06:33:11Z","modified":"2026-10-20T13:45:03.959216507Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792490955","title":"TuxCare security update for send (1 CVE)","description":"TuxCare rebuilt send to address 1 CVE. Fixed in 0.16.2-tuxcare.1.","status":"published","published":"2026-10-20T10:09:15Z","modified":"2026-10-20T13:45:16.978989628Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792496437","title":"TuxCare security update for send (3 CVEs)","description":"TuxCare rebuilt send to address 3 CVEs. Fixed in 0.7.4-tuxcare.1.","status":"published","published":"2026-10-20T11:40:37Z","modified":"2026-10-20T13:45:21.725870275Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793098701","title":"TuxCare security update for send (1 CVE)","description":"TuxCare rebuilt send to address 1 CVE. Fixed in 0.17.1-tuxcare.1.","status":"published","published":"2026-10-27T10:58:21Z","modified":"2026-10-27T13:30:13.026890602Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793291196","title":"TuxCare security update for send (1 CVE)","description":"TuxCare rebuilt send to address 1 CVE. Fixed in 0.13.0-tuxcare.1.","status":"published","published":"2026-10-29T17:26:37Z","modified":"2026-10-29T19:45:49.86470775Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793292510","title":"TuxCare security update for send (3 CVEs)","description":"TuxCare rebuilt send to address 3 CVEs. Fixed in 0.1.4-tuxcare.1.","status":"published","published":"2026-10-29T17:48:31Z","modified":"2026-10-29T19:45:51.716453024Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-4224-1","title":"node-send - security update","status":"published","published":"2025-06-23T00:00:00Z","modified":"2026-03-09T02:11:35.669203Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"ROOT-APP-NPM-CVE-2024-43799","title":"CVE-2024-43799 in @rootio/send - Patched by Root","description":"Root has patched CVE-2024-43799 in the @rootio/send package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-27T12:16:03Z","modified":"2026-07-27T19:45:12.04472352Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}