{"id":"CVE-2024-9266","aliases":["CLSA-2026-1773015274","CLSA-2026-1793833558","EUVD-2024-3071","GHSA-jj78-5fmv-mv28"],"status":"published","title":"Open Redirect","description":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0046,"percentile":0.40124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2024-10-03T18:56:38Z","modified":"2026-11-05T13:15:13Z","fixes":[{"ecosystem":"npm","package":"express","fixed_in":["4.0.0-rc1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"4.0.0-rc1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.2-tuxcare.0"},{"fixed":"3.21.2-tuxcare.1"}]}],"versions":["3.21.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.8-tuxcare.0"},{"fixed":"3.4.8-tuxcare.3"}]}],"versions":["3.4.8","3.4.8-tuxcare.1","3.4.8-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"express","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.5"},{"fixed":"4.0.0-rc1"}]}]}],"products":[{"vendor":"@clerk","product":"express"},{"vendor":"expressjs","product":"express"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2024-9266","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9266","tags":["advisory"]},{"url":"https://github.com/expressjs/express/compare/3.4.4...3.4.5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jj78-5fmv-mv28"},{"url":"https://github.com/expressjs/express","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-9266","title":"Open Redirect","description":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.","status":"published","published":"2024-10-03T18:56:38.143Z","modified":"2024-10-03T19:20:08.901Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:34:06.147811Z"}],"euvd":[{"id":"EUVD-2024-3071","description":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.","status":"published","published":"2024-10-03T18:56:38Z","modified":"2024-10-03T19:20:08Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:27:53.790276Z"}],"ghsa":[{"id":"GHSA-jj78-5fmv-mv28","title":"Express Open Redirect vulnerability","description":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0-rc1.","status":"published","published":"2024-10-03T21:31:05Z","modified":"2024-10-09T23:46:56Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:P","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2024-9266","description":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.","status":"published","published":"2024-10-03T19:15:05.027Z","modified":"2026-06-17T08:24:15.003Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:10:30.673028Z"}],"osv":[{"id":"GHSA-jj78-5fmv-mv28","title":"Express Open Redirect vulnerability","description":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0-rc1.","status":"published","published":"2024-10-03T21:31:05Z","modified":"2024-10-09T23:46:55Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"CLSA-2026-1773015274","title":"TuxCare security update for express (4 CVEs)","description":"TuxCare rebuilt express to address 4 CVEs. Fixed in 3.21.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:42.155476247Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1793833558","title":"TuxCare security update for express (2 CVEs)","description":"TuxCare rebuilt express to address 2 CVEs. Fixed in 3.4.8-tuxcare.3.","status":"published","published":"2026-11-05T00:06:00Z","modified":"2026-11-05T13:15:13.562947134Z","updated_at":"2026-11-05T13:30:00.949926Z"}]}}