CVE-2024-29041 — Open Redirect in Express

CWE-601 — Open RedirectCWE-1286 — Improper Validation of Syntactic Correctness of Input11 documents9 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 63.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Openjsf ExpressExpressExpressjs Express
Timeline
PublishedMar 25
Latest updateJun 19

Description

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redir…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDopenjsf/express< 4.19.2+1
▶npmexpress/express5.0.0-alpha.1 — 5.0.0-beta.3+1
▶CVEListV5expressjs/express>=4.14.0, <4.19.0, >=5.0.0-alpha.1, <5.0.0-beta.3+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
node-express vulnerabilities↗2025-06-19
▶
CVEList
Express.js Open Redirect in malformed URLs↗2024-03-25
▶
OSV
Express.js Open Redirect in malformed URLs↗2024-03-25
▶
GHSA
Express.js Open Redirect in malformed URLs↗2024-03-25
▶
OSV
CVE-2024-29041: Express↗2024-03-25
▶

📋Vendor Advisories

5
Ubuntu
Express vulnerabilities↗2025-06-19
▶
Oracle
Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Express.js) — CVE-2024-29041↗2025-01-15
▶
Red Hat
express: cause malformed URLs to be evaluated↗2024-03-25
▶
Microsoft
Express.js Open Redirect in malformed URLs↗2024-03-12
▶
Debian
CVE-2024-29041: node-express - Express.js minimalist web framework for node. Versions of Express.js prior to 4....↗2024
▶
CVE-2024-29041 — Open Redirect in Openjsf Express | cvebase