GHSA-jj78-5fmv-mv28

Express Open Redirect vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2024-9266

Packages

Ecosystem	Package	Affected	Fixed in
npm	express	>= 3.4.5, < 4.0.0-rc1	4.0.0-rc1

Details

As written in the advisory (Markdown source, shown as plain text).

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0-rc1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-9266 advisory
https://github.com/expressjs/express package
https://github.com/expressjs/express/compare/3.4.4...3.4.5 web
https://www.herodevs.com/vulnerability-directory/cve-2024-9266 web