{"id":"CVE-2024-43800","aliases":["AZL-49094","AZL-49147","AZL-49155","CLSA-2026-1784856192","CLSA-2026-1792490203","DEBIAN-CVE-2024-43800","EUVD-2024-2771","GHSA-cm22-4g7w-348p","ROOT-APP-NPM-CVE-2024-43800","UBUNTU-CVE-2024-43800"],"status":"published","title":"serve-static affected by template injection that can lead to XSS","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00631,"percentile":0.50586,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-09-10T14:50:06Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"serve-static","fixed_in":["1.16.0","2.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-13"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"serve-static","fixed_in":["1.10.3-tuxcare.1","1.13.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-serve-static","fixed_in":["2.1.0+~1.15.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-serve-static","fixed_in":["2.1.0+~1.15.7-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/serve-static","fixed_in":["1.15.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"serve-static","fixed_in":["1.15.0-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.3-tuxcare.0"},{"fixed":"1.10.3-tuxcare.1"}]}],"versions":["1.10.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2-tuxcare.0"},{"fixed":"1.13.2-tuxcare.1"}]}],"versions":["1.13.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0+~1.15.0-1","1.15.0+~1.15.7-1","2.1.0+~1.15.7-1","2.1.0+~1.15.7-2","2.2.0+~1.15.9-1","2.2.0+~2.2.0-1","2.2.1+~2.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0+~1.15.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0+~1.15.7-1"}]}]},{"source":"osv","ecosystem":"npm","package":"serve-static","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"npm","package":"serve-static","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.4-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.4-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.4-4","1.14.1-2","1.14.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.1-3","1.14.2+~1.13.10-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0+~1.15.0-1","1.15.0+~1.15.7-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+~1.15.7-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1+~2.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+~1.15.7-2","2.2.0+~1.15.9-1","2.2.0+~2.2.0-1build1","2.2.1+~2.2.0-1"]}],"products":[{"vendor":"expressjs","product":"serve-static"},{"vendor":"openjsf","product":"serve-static"}],"references":[{"url":"https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43800","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cm22-4g7w-348p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43800.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-43800","tags":["advisory"]},{"url":"https://github.com/expressjs/serve-static","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-43800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-43800","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-43800","title":"serve-static affected by template injection that can lead to XSS","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T14:50:06.043Z","modified":"2024-09-10T19:08:02.494Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:58.357949Z"}],"euvd":[{"id":"EUVD-2024-2771","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T14:50:06Z","modified":"2024-09-10T19:08:02Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:58.744683Z"}],"ghsa":[{"id":"GHSA-cm22-4g7w-348p","title":"serve-static vulnerable to template injection that can lead to XSS","description":"### Impact\n\npassing untrusted user input - even after sanitizing it - to `redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in serve-static 1.16.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n","status":"published","published":"2024-09-10T19:42:33Z","modified":"2024-11-18T16:27:12Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:20.833758Z"}],"nvd":[{"id":"CVE-2024-43800","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T15:15:17.937Z","modified":"2026-06-17T07:51:44.28Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"AZL-49094","title":"CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-4","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-04-21T04:29:46.102823Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49147","title":"CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-04-21T04:29:47.277116Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49155","title":"CVE-2024-43800 affecting package nodejs-nodemon 2.0.3-5","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T15:15:17Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"CVE-2024-43800","title":"serve-static affected by template injection that can lead to XSS","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T14:50:06.043Z","modified":"2026-10-28T02:30:50.157621148Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-43800","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T15:15:17.937Z","modified":"2026-11-02T12:02:47.222631124Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"GHSA-cm22-4g7w-348p","title":"serve-static vulnerable to template injection that can lead to XSS","description":"### Impact\n\npassing untrusted user input - even after sanitizing it - to `redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in serve-static 1.16.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n","status":"published","published":"2024-09-10T19:42:33Z","modified":"2026-09-10T03:50:18.868190591Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2024-43800","description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","status":"published","published":"2024-09-10T15:15:00Z","modified":"2026-10-17T12:56:44.983770595Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"CLSA-2026-1784856192","title":"TuxCare security update for serve-static (1 CVE)","description":"TuxCare rebuilt serve-static to address 1 CVE. Fixed in 1.10.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.994480225Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792490203","title":"TuxCare security update for serve-static (1 CVE)","description":"TuxCare rebuilt serve-static to address 1 CVE. Fixed in 1.13.2-tuxcare.1.","status":"published","published":"2026-10-20T09:56:43Z","modified":"2026-10-20T13:45:13.414218114Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"ROOT-APP-NPM-CVE-2024-43800","title":"CVE-2024-43800 in @rootio/serve-static - Patched by Root","description":"Root has patched CVE-2024-43800 in the @rootio/serve-static package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-27T11:55:34Z","modified":"2026-07-27T13:15:24.738142126Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}