| Package | Affected versions | Patched versions |
|---|---|---|
| express | = 4.0.0= 4.1.0= 4.1.1= 4.1.2= 4.2.0= 4.3.0= 4.3.1= 4.3.2= 4.4.0= 4.4.1= 4.4.2= 4.4.3= 4.4.4= 4.4.5≤ 3.10.5 | |
| express | ≥ 4.0.0, < 4.5.0< 3.11.0 | 4.5.03.11.0 |
Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.
For express 3.x, update express to version 3.11 or later. For express 4.x, update express to version 4.5 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free