Vulnerabilities (CVE)

Filtered by vendor Openjsf Subscribe
Filtered by product Express
Total 4 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-24999 3 Debian, Openjsf, Qs Project 3 Debian Linux, Express, Qs 2024-11-21 N/A 7.5 HIGH
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
CVE-2014-6393 1 Openjsf 1 Express 2024-11-21 4.3 MEDIUM 6.1 MEDIUM
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
CVE-2024-10491 1 Openjsf 1 Express 2024-11-06 N/A 5.3 MEDIUM
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.
CVE-2024-43796 1 Openjsf 1 Express 2024-09-20 N/A 4.7 MEDIUM
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.