Packages / express / Security

LowVulnerabilityGHSA-jj78-5fmv-mv28CVE-2024-9266Published 3 Oct 2024

Express Open Redirect vulnerability

Affected releases · express

  • 3.x3.4.5 – 3.21.2No fix on this line yet

3.x has no fix yet; the newest fixed line:

npm install express@4.0.0-rc1
5.x

  1. Not affected

    5.0.0 – 5.3.0

    6 releases, latest

3.x

  1. Not affected

    3.0.0 – 3.4.4

    31 releases

  2. Affected

    3.4.5 – 3.21.2

    65 releases

247 stable releases of express, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for express. It is read in your browser and sent nowhere.

What happens

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0-rc1.