CVE-2024-43796 — Cross-site Scripting in Express

CWE-79 — Cross-site Scripting13 documents9 sources
Severity
4.7MEDIUMNVD
CNA5.0OSV6.1
EPSS
0.1%
top 69.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Expressjs ExpressOpenjsf ExpressExpress
Timeline
PublishedSep 10
Latest updateJan 15

Description

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 1.6 | Impact: 2.7

Affected Packages3 packages

▶NVDopenjsf/express< 4.20.0+1
▶npmexpress/express5.0.0-alpha.1 — 5.0.0+1
▶CVEListV5expressjs/express< 4.20.0+1

Patches

Patch: github.com ↗

🔴Vulnerability Details

5
OSV
node-express vulnerabilities↗2025-06-19
▶
OSV
CVE-2024-43796: Express↗2024-09-10
▶
OSV
express vulnerable to XSS via response.redirect()↗2024-09-10
▶
GHSA
express vulnerable to XSS via response.redirect()↗2024-09-10
▶
CVEList
express vulnerable to XSS via response.redirect()↗2024-09-10
▶

📋Vendor Advisories

7
Oracle
Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Express.js) — CVE-2024-43796↗2026-01-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: User Interface (Express.js) — CVE-2024-43796↗2025-07-15
▶
Ubuntu
Express vulnerabilities↗2025-06-19
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: User Interface (Express.js) — CVE-2024-43796↗2025-04-15
▶
Microsoft
express vulnerable to XSS via response.redirect()↗2024-09-10
▶
CVE-2024-43796 — Cross-site Scripting in Express | cvebase