← Vulnerability feed

Vulnerability record · CVE-2024-29041 · published 25 March 2024

CVE-2024-29041: Openjsf express open redirect vulnerability

Openjsf · Express

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

6.1 CVSS 3.1 Medium EPSS 0.79% · top 45.6% CWE-601 · Open redirectCWE-1286 · CWE-1286
6.1CVSS 3.1 base score
0.79%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://expressjs.com/en/4x/api.html#res.location Technical Description
https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd Patch
https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94 Patch
https://github.com/expressjs/express/pull/5539 Issue Tracking
https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc PatchVendor Advisory
https://github.com/koajs/koa/issues/1800 Issue Tracking
https://expressjs.com/en/4x/api.html#res.location Technical Description
https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd Patch
https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94 Patch
https://github.com/expressjs/express/pull/5539 Issue Tracking
https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc PatchVendor Advisory
https://github.com/koajs/koa/issues/1800 Issue Tracking

Track CVE-2024-29041 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2022-24999Qs project qs prototype pollution vulnerabilityqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application becau…EPSS 16%6.1CVE-2014-6393Openjsf express cross-site scripting vulnerabilityThe Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level respo…EPSS 1.1%5.3CVE-2024-10491Openjsf express injection vulnerabilityA vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanit…EPSS 0.44%4.7CVE-2024-43796Openjsf express cross-site scripting vulnerabilityExpress.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() m…EPSS 0.49%4.7CVE-2012-0518Oracle Fusion Middleware SSO open redirect flawOracle Fusion Middleware 10.1.4.3.0 contains an unspecified open redirect vulnerability in the Application Server Single Sign-On component, tracked a…KEVEPSS 4.7%analysed6.1CVE-2021-38000Google Chrome Android Intents input validation open redirectChrome on Android before 95.0.4638.69 fails to properly validate untrusted input passed through Intents, allowing a crafted HTML page to redirect the…KEVEPSS 4.9%analysed

Source: NIST National Vulnerability Database (record CVE-2024-29041), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.