@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. An issue exists where, under...

Multer security vulnerabilities

Multer is an open-source middleware for Node.js developed by ExpressJS. Versions of Multer prior to 2.1.1 contained a security vulnerability caused by a stack overflow issue when handling malformed requests, which could lead to a denial-of-service attack...

EUVD-2025-205796

Malicious code in express-js-web npm...

Malicious Package

Overview express-js-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in express-js-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e922c32d1b163c8938985f7665f539243b9be99316491150e61476d30cf0ce68 The package express-js-web was found to contain malicious code. Source: ghsa-malware 50f874487616a31800182c5b87aec47559f7136d5ed3a84355446b795a3137d7...

MAL-2025-192968 Malicious code in express-js-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e922c32d1b163c8938985f7665f539243b9be99316491150e61476d30cf0ce68 The package express-js-web was found to contain malicious code. Source: ghsa-malware 50f874487616a31800182c5b87aec47559f7136d5ed3a84355446b795a3137d7...

Malware in express-js-web

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2022-1363

Malicious code in bioql PyPI...

Multer security vulnerabilities

Multer is an expressjs open source middleware for Node.js. A security vulnerability exists in Multer versions 1.4.4-lts.1 through prior to 2.0.2, which stems from an unhandled exception in the handling of malformed multipart upload requests, which could lead to a denial of service...

AZL-43690 CVE-2024-29041 affecting package nodejs-nodemon 2.0.3-4

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an...

CVE-2022-24794

Express OpenID Connect (express-openid-connect) CVE-2022-24794 describes an Open Redirect vulnerability when requiresAuth is applied on a catch-all route. Affected versions are prior to 2.7.2. The issue arises because the original URL reported by the Express framework is not properly sanitized, a...

CVE-2022-24794

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the "requiresAuth" middleware, either directly or through the default "authRequired" option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

CVE-2022-24794: URL Redirection to Untrusted Site

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

CVE-2021-41246

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including "2.5.1" do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...

CVE-2021-41246: Session Fixation

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...