EX
Product
Express
5
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 4Low 0
Watch
Add Express to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-24999 | 7.5 | Nov 26 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be… Affected: before 4.17.3 |
| CVE-2024-29041 | 6.1 | Mar 25 | Express.js Open Redirect in malformed URLs Affected: before 4.19.2; 5.0.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +5 more |
| CVE-2014-6393 | 6.1 | Aug 9 | The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote… Affected: through 3.10.5; 4.0.0; 4.1.0; 4.1.1; 4.1.2; 4.2.0; +9 more |
| CVE-2024-10491 | 5.3 | Oct 29 | Preload arbitrary resources by injecting additional `Link` headers Affected: 3.0.0 before 3.21.5 |
| CVE-2024-43796 | 4.7 | Sep 10 | express vulnerable to XSS via response.redirect() Affected: before 4.20.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +6 more |
Showing 5