Express Open Redirect vulnerability

MEDIUM 4.7CVE-2024-9266 · GHSA-jj78-5fmv-mv28 · Published 03/10/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
express npm	`≥ 3.4.5, < 4.0.0-rc1`	`4.0.0-rc1`

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0-rc1.

NVD description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.

References

nvd.nist.gov/vuln/detail/CVE-2024-9266 · ADVISORY
expressjs/express · PACKAGE
expressjs/express · WEB
herodevs.com/vulnerability-directory/cve-2024-9266 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free