Express.js 安全漏洞

🗓️ 25 Mar 2024 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 4 Views

Express.js has an open redirect vulnerability in versions before 4.19.0 and 5.0 due to malformed URLs.

Reporter	Title	Published	Views	Family All 101
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for April 2024.	27 Apr 202413:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: PVR0501342 [Express - CVE-2024-29041 (Publicly disclosed vulnerability) ]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in express-4.17.3.tgz	7 Jul 202517:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance vulnerable to open redirect (CVE-2024-29041)	26 Jun 202422:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance has multiple vulnerabilities	10 Jul 202416:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Information Queue	5 Aug 202409:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses express-4.18.2.tgz which is vulnerable to CVE-2024-29041.	6 Jun 202406:30	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion HCI and IBM Fusion HCI for watsonx	31 May 202514:07	–	ibm

Source	Link
github	www.github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd
github	www.github.com/expressjs/express/pull/5539
github	www.github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94
github	www.github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc
github	www.github.com/koajs/koa/issues/1800
expressjs	www.expressjs.com/en/4x/api.html
cxsecurity	www.cxsecurity.com/cveshow/CVE-2024-29041/
oracle	www.oracle.com/security-alerts/cpujan2025.html

15 Jan 2026 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.1

EPSS0.00786

SSVC

express framework open redirects malformed web addresses security vulnerability vulnerable versions