No Charset in Content-Type Header in express
Affected releases · express
- 4.x4.0.0 – 4.4.5Fixed in 4.5.0
- 3.x3.0.0 – 3.10.5Fixed in 3.11.0
- 2.x and older0.14.0 – 2.5.11No fix, no longer updated
On 4.x, the newest line:
npm install express@4.5.0Not affected
5.0.0 – 5.3.0
6 releases, latest
Affected
4.0.0 – 4.4.5
14 releases
Fixed
4.5.0 – 4.22.3
81 releases
Affected
3.0.0 – 3.10.5
50 releases
Fixed
3.11.0 – 3.21.2
46 releases
Affected
2.0.0 – 2.5.11
39 releases
Affected
1.0.0 – 1.0.8
9 releases
Affected
0.14.0 – 0.14.1
2 releases
Is your project affected?
Paste your package.json, or type the range you declare for express. It is read in your browser and sent nowhere.
What happens
Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.
Recommendation
For express 3.x, update express to version 3.11 or later. For express 4.x, update express to version 4.5 or later.