Expressjs vulnerabilities

Products

• Multer 15
• Express 4

Newest

• expressjs multer multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown CVE-2026-113872 Public exploitFix available 7.5 HighOctober 22, 2026
• expressjs multer multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads CVE-2026-88932 Fix available 5.3 MediumSeptember 14, 2026
• expressjs multer multer vulnerable to Denial of Service via oversized array index in field names CVE-2026-82333 Fix available 7.5 HighAugust 28, 2026
• expressjs multer multer vulnerable to Denial of Service via crafted multipart field names CVE-2026-77078 Public exploitFix available 7.5 HighAugust 28, 2026
• expressjs multer multer vulnerable to file size limit bypass via async fileFilter race condition CVE-2026-77063 Fix available 3.7 LowAugust 28, 2026
• expressjs multer multer vulnerable to Denial of Service via file descriptor leak on aborted uploads CVE-2026-77037 Fix available 7.5 HighAugust 28, 2026
• expressjs multer multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads CVE-2026-5038 Fix available 5.3 MediumJune 15, 2026
• expressjs multer multer vulnerable to Denial of Service via deeply nested field names CVE-2026-5079 Fix available 7.5 HighJune 15, 2026
• expressjs multer, red hat developer hub 1.8, developer hub 1.9 +1 more +3 more Multer vulnerable to Denial of Service via uncontrolled recursion CVE-2026-3520 Fix available 8.7 HighMarch 4, 2026
• expressjs multer, red hat logging subsystem for red hat openshift, developer hub 1.8 +7 more +9 more Multer vulnerable to Denial of Service via incomplete cleanup CVE-2026-3304 Public exploitFix available 8.7 HighFebruary 27, 2026
• expressjs multer, red hat logging subsystem for red hat openshift, developer hub 1.8 +7 more +9 more Multer vulnerable to Denial of Service via resource exhaustion CVE-2026-2359 Fix available 8.7 HighFebruary 27, 2026
• expressjs multer Multer vulnerable to Denial of Service via unhandled exception from malformed request CVE-2025-7338 Public exploitFix available 7.5 HighJuly 17, 2025
• expressjs multer Multer vulnerable to Denial of Service via unhandled exception CVE-2025-48997 Fix available 8.7 HighJune 3, 2025
• expressjs multer Multer vulnerable to Denial of Service from maliciously crafted requests CVE-2025-47944 Fix available 7.5 HighMay 19, 2025
• expressjs multer Multer vulnerable to Denial of Service via memory leaks from unclosed streams CVE-2025-47935 Fix available 7.5 HighMay 19, 2025
• @clerk express Preload arbitrary resources by injecting additional `Link` headers CVE-2024-10491 Fix available 4.0 MediumOctober 29, 2024
• @clerk express Open Redirect CVE-2024-9266 Fix available 4.7 MediumOctober 3, 2024
• expressjs basic-auth-connect basic-auth-connect's callback uses time unsafe string comparison CVE-2024-47178 Fix available 8.7 HighSeptember 30, 2024
• body-parser body-parser vulnerable to denial of service when url encoding is enabled CVE-2024-45590 Public exploitFix available 7.5 HighSeptember 10, 2024
• expressjs serve-static serve-static affected by template injection that can lead to XSS CVE-2024-43800 Fix available 5.0 MediumSeptember 10, 2024
• @clerk express express vulnerable to XSS via response.redirect() CVE-2024-43796 Fix available 5.0 MediumSeptember 10, 2024
• @clerk express Express.js Open Redirect in malformed URLs CVE-2024-29041 Fix available 6.1 MediumMarch 25, 2024
• expressjs method-override, hackerone method-override node module +1 more method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header CVE-2017-16136 Fix available 7.5 HighJune 7, 2018