EX
Vendor
expressjs
21
CVEs
0
On KEV
0
New 30D
Products
MU8.7
multer
expressjs
13 CVEs0 on KEV0 new
EX6.1
express
expressjs
4 CVEs0 on KEV0 new
BA5.3
basic-auth-connect
expressjs
1 CVEs0 on KEV0 new
BO7.5
body-parser
expressjs
1 CVEs0 on KEV0 new
ME7.5
Method-override
Expressjs
1 CVEs0 on KEV0 new
SE4.7
serve-static
expressjs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82333 | MU Multer Expressjs | 7.5 | Aug 28 | multer vulnerable to Denial of Service via oversized array index in field names |
| CVE-2026-77078 | MU Multer Expressjs | 7.5 | Aug 28 | multer vulnerable to Denial of Service via crafted multipart field names |
| CVE-2026-77063 | MU Multer Expressjs | 3.7 | Aug 28 | multer vulnerable to file size limit bypass via async fileFilter race condition |
| CVE-2026-77037 | MU Multer Expressjs | 7.5 | Aug 28 | multer vulnerable to Denial of Service via file descriptor leak on aborted uploads |
| CVE-2026-5038 | MU Multer Expressjs | 7.5 | Jun 15 | multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads |
| CVE-2026-5079 | MU Multer Expressjs | 7.5 | Jun 15 | multer vulnerable to Denial of Service via deeply nested field names |
| CVE-2026-3520 | MU multer expressjs | 7.5 | Mar 4 | Multer vulnerable to Denial of Service via uncontrolled recursion |
| CVE-2026-3304 | MU multer expressjs | 7.5 | Feb 27 | Multer vulnerable to Denial of Service via incomplete cleanup |
| CVE-2026-2359 | MU multer expressjs | 7.5 | Feb 27 | Multer vulnerable to Denial of Service via resource exhaustion |
| CVE-2025-7338 | MU multer expressjs | 7.5 | Jul 17 | Multer vulnerable to Denial of Service via unhandled exception from malformed request |
| CVE-2025-48997 | MU multer expressjs | 8.7 | Jun 3 | Multer vulnerable to Denial of Service via unhandled exception |
| CVE-2025-47944 | MU multer expressjs | 7.5 | May 19 | Multer vulnerable to Denial of Service from maliciously crafted requests |
| CVE-2025-47935 | MU multer expressjs | 7.5 | May 19 | Multer vulnerable to Denial of Service via memory leaks from unclosed streams |
| CVE-2024-10491 | EX Express Expressjs | 5.3 | Oct 29 | Preload arbitrary resources by injecting additional `Link` headers |
| CVE-2024-9266 | EX express expressjs | 4.7 | Oct 3 | Open Redirect |
| CVE-2024-47178 | BA basic-auth-connect expressjs | 5.3 | Sep 30 | basic-auth-connect's callback uses time unsafe string comparison |
| CVE-2024-45590 | BO body-parser expressjs | 7.5 | Sep 10 | body-parser vulnerable to denial of service when url encoding is enabled |
| CVE-2024-43800 | SE serve-static expressjs | 4.7 | Sep 10 | serve-static affected by template injection that can lead to XSS |
| CVE-2024-43796 | EX express expressjs | 4.7 | Sep 10 | express vulnerable to XSS via response.redirect() |
| CVE-2024-29041 | EX express expressjs | 6.1 | Mar 25 | Express.js Open Redirect in malformed URLs |
| CVE-2017-16136 | ME Method-override Expressjs | 7.5 | Jun 7 | method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it |