express
5.3.0 · 9 Oct 2026MIT87.4M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for express. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 5.3.0 | No known advisory | |
| 4.22.3 | Safe from 4.20.0 | |
| 3.21.2 | 16 open advisories, worst moderate · last release Jul 2015, no longer updated |
- ModerateExpress ressource injectionGHSA-cm5g-3pgc-8rg4 · 29 Oct 2024
- 3.x and older0.14.0 – 3.21.2No fix, no longer updated
- ModerateExpress.js Open Redirect in malformed URLsGHSA-rv95-896h-c2vc · 25 Mar 2024
- 4.x4.0.0 – 4.19.1Fixed in 4.19.2
- 3.x and older0.14.0 – 3.21.2No fix, no longer updated · move to 4.19.2
- ModerateNo Charset in Content-Type Header in expressGHSA-gpvr-g6gh-9mc2 · 23 Oct 2018
- 4.x4.0.0 – 4.4.5Fixed in 4.5.0
- 3.x3.0.0 – 3.10.5Fixed in 3.11.0
- 2.x and older0.14.0 – 2.5.11No fix, no longer updated · move to 3.11.0
- LowExpress Open Redirect vulnerabilityGHSA-jj78-5fmv-mv28 · 3 Oct 2024
- 3.x3.4.5 – 3.21.2No fix on 3.x
- Lowexpress vulnerable to XSS via response.redirect()GHSA-qw6h-vgh9-j6wx · 10 Sep 2024
- 4.x4.0.0 – 4.19.2Fixed in 4.20.0
- 3.x and older0.14.0 – 3.21.2No fix, no longer updated · move to 4.20.0
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.