Express.js Open Redirect in malformed URLs (expressjs express)

CVE-2024-29041

MEDIUM 6.1

At a glance

Source: NVD
EPSS: EPSS 0.79 % · percentile 56 (2026-10-31)
State: PUBLISHED
Published: 2024-03-25 20:20 UTC
Updated: 2024-08-02 01:03 UTC
Assigner: GitHub_M
NVD status: Analyzed

Search on…

Description

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Weaknesses (CWE)

CWE-601 — URL Redirection to Untrusted Site
CWE-1286 — Improper Validation of Syntactic Correctness of Input

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	GitHub_M
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · security-advisories@github.com (Secondary)

Advisories

GHSA-rv95-896h-c2vc — Express.js Open Redirect in malformed URLs

European references

ENISA EUVD · EUVD-2024-1007
GCVE · GCVE-0-2024-29041

CERT-FR advisories

CERTFR-2026-AVI-1233 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2025-AVI-0627 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2025-AVI-0233 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2025-AVI-0106 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-1103 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0726 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0692 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0630 — Multiples vulnérabilités dans IBM QRadar · cert.ssi.gouv.fr
CERTFR-2024-AVI-0579 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0514 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:* < 4.19.2
cpe:2.3:a:openjsf:express:5.0.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:alpha2:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:alpha3:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:alpha4:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:alpha5:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:alpha6:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:alpha7:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:alpha8:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:beta1:*:*:*:node.js:*:*
cpe:2.3:a:openjsf:express:5.0.0:beta2:*:*:*:node.js:*:*

Affected products

Product	Versions
expressjs · express	affected >=4.14.0, <4.19.0 ; affected >=5.0.0-alpha.1, <5.0.0-beta.3

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Express.js Open Redirect in malformed URLs (expressjs express)