CVE-2024-43796: express vulnerable to XSS via response.redirect()

September 10, 2024 (updated November 18, 2024)

In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code

References

github.com/advisories/GHSA-qw6h-vgh9-j6wx
github.com/expressjs/express
github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553
github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx
nvd.nist.gov/vuln/detail/CVE-2024-43796

Code Behaviors & Features

Detect and mitigate CVE-2024-43796 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →