# cve.now: Express

The newest entries affecting Express (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2024-10491](https://cve.now/CVE-2024-10491.md): Preload arbitrary resources by injecting additional \`Link\` headers (CVSS 4.0, express)
- [CVE-2024-9266](https://cve.now/CVE-2024-9266.md): Open Redirect (CVSS 4.7, expressjs express · express)
- [CVE-2024-43796](https://cve.now/CVE-2024-43796.md): express vulnerable to XSS via response.redirect() (CVSS 5.0, expressjs express · express)
- [CVE-2024-29041](https://cve.now/CVE-2024-29041.md): Express.js Open Redirect in malformed URLs (CVSS 6.1, expressjs express · express)
- [CVE-2022-21169](https://cve.now/CVE-2022-21169.md): Prototype Pollution (CVSS 7.3, express-xss-sanitizer)
- [CVE-2020-7767](https://cve.now/CVE-2020-7767.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, express-validators)
- [CVE-2020-7699](https://cve.now/CVE-2020-7699.md): Prototype Pollution (CVSS 7.5, express-fileupload)
- [CVE-2020-7616](https://cve.now/CVE-2020-7616.md): express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. (no CVSS, express-mock-middleware)
- [CVE-2014-6393](https://cve.now/CVE-2014-6393.md): The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 le (no CVSS, express)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/express
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.