Loading vulnerability…
XSS in serve-static redirect handling
CVE-2024-43800 is an improper sanitization flaw in the Node.js serve-static middleware. User-controlled input can reach the redirect rendering path even after sanitization and may be interpreted as untrusted code in the redirect template, enabling cross-site scripting. The issue affects vulnerable serve-static releases prior to the fixed versions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may execute script in a victim's browser in the security context of an application using the affected middleware. Consequences can include access to application-origin data available to the victim, session or token theft where not protected, unauthorized actions performed as the victim, and presentation of attacker-controlled content.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted values from reaching redirect handling. Strictly validate redirect-related input against an explicit allowlist of expected paths or destinations, reject template-significant characters and malformed input, and apply contextual output encoding. Deploy Content Security Policy as defense in depth.
Patch, then assume compromise.
Upgrade serve-static to version 1.16.0 or later for the 1.x branch, or version 2.1.0 or later for the 2.x branch. Update affected application dependencies and rebuild and redeploy any container images or packaged applications that bundle the vulnerable library.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.