Loading vulnerability…
Cross-Site Scripting in Express response.redirect()
CVE-2024-43796 is an improper input-handling vulnerability in Express.js redirect processing that can result in cross-site scripting. In Express versions before 4.20.0, passing attacker-controlled input to response.redirect() can cause untrusted code to execute in a recipient's browser, including when the application has sanitized that input before passing it to the redirect API. Express 5.0.0-alpha.1 through versions before 5.0.0 are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may cause JavaScript of their choosing to execute in the browser of a user who receives or follows a crafted redirect response. The resulting impact depends on the affected application's origin and browser context, and can include actions performed as the victim, access to application data available to the victim's session, or modification of rendered content.
If you can’t patch tonight, do this now.
Until upgrading is possible, do not pass user-controlled values directly to response.redirect(). Enforce a strict allowlist of permitted redirect destinations or application-relative routes, reject malformed or unexpected values, and avoid relying solely on generic sanitization for redirect targets.
Patch, then assume compromise.
Upgrade Express 4.x to version 4.20.0 or later, or upgrade Express 5.x to version 5.0.0 or later. Rebuild and redeploy dependent application containers or packages so that the patched Express dependency is used in production.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.