Known vulnerabilities in Express
Vendor:
Express.js
Software:
Express
Software CPE:
cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*
Website:
https://expressjs.com/
Total vulnerabilities:
4
Public exploits:
1
Known exploited (KEV):
0
Highest CVSSv4 Score:
8.8
Breakdown by Severity Chart
4.22.2
5.2.1
5.2.0
4.22.1
4.22.0
5.1.0
4.21.2
5.0.1
4.21.1
4.21.0
4.20.0
5.0.0
5.0.0-beta.3
4.19.2
4.19.1
4.19.0
4.18.3
4.18.2
4.18.1
4.18.0
4.17.3
4.17.2
4.17.1
4.17.0
4.16.4
4.16.3
4.16.2
4.16.1
4.16.0
4.15.5
4.15.4
4.15.3
4.15.2
4.15.1
4.15.0
4.14.1
4.14.0
4.13.4
4.13.3
4.13.2
4.13.1
4.13.0
4.12.4
4.12.3
4.12.2
4.12.1
4.12.0
4.11.2
4.11.1
4.11.0
4.10.8
4.10.7
4.10.6
4.10.5
4.10.4
4.10.3
4.10.2
4.10.1
4.10.0
4.9.8
4.9.7
4.9.6
4.9.5
4.9.4
4.9.3
4.9.2
4.9.1
4.9.0
4.8.8
4.8.7
4.8.6
4.8.5
4.8.4
4.8.3
4.8.2
4.8.1
4.8.0
4.7.4
4.7.3
4.7.2
4.7.1
4.7.0
4.6.1
4.6.0
4.5.1
4.5.0
4.4.5
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.3.2
4.3.1
4.3.0
4.2.0
4.1.2
4.1.1
4.1.0
4.0.0
3.21.2
3.21.1
3.21.0
3.20.3
3.20.2
3.20.1
3.20.0
3.19.2
3.19.1
3.19.0
3.18.6
3.18.5
3.18.4
3.18.3
3.18.2
3.18.1
3.18.0
3.17.8
3.17.7
3.17.6
3.17.5
3.17.4
3.17.3
3.17.2
3.17.1
3.17.0
3.16.10
3.16.9
3.16.8
3.16.7
3.16.6
3.16.5
3.16.4
3.16.3
3.16.2
3.16.1
3.16.0
3.15.3
3.15.2
3.15.1
3.15.0
3.14.0
3.13.0
3.12.1
3.12.0
3.11.0
3.10.5
3.10.4
3.10.3
3.10.2
3.10.1
3.10.0
3.9.0
3.8.1
3.8.0
3.7.0
3.6.0
3.5.3
3.5.2
3.5.1
3.5.0
3.4.8
3.4.7
3.4.6
3.4.5
3.4.4
3.4.3
3.4.2
3.4.1
3.4.0
3.3.8
3.3.7
3.3.6
3.3.5
3.3.4
3.3.3
3.3.2
3.3.1
3.3.0
3.2.6
3.2.5
3.2.4
3.2.3
3.2.2
3.2.1
3.2.0
3.1.2
3.1.1
3.1.0
3.0.6
3.0.5
3.0.4
3.0.3
3.0.2
3.0.1
2.5.11
2.5.10
2.5.9
2.5.4
2.5.3
2.5.2
2.5.1
2.5.0
2.4.7
2.4.5
2.4.4
2.4.3
2.4.2
2.4.1
2.4.0
2.3.12
2.3.11
2.3.10
2.3.9
2.3.8
2.3.7
2.3.6
2.3.5
2.3.4
2.3.3
2.3.2
2.3.1
2.3.0
2.2.2
2.2.1
2.2.0
2.1.1
2.1.0
2.0.0
1.0.9
1.0.8
1.0.7
1.0.6
1.0.5
1.0.4
1.0.3
1.0.2
1.0.1
1.0.0
0.14.1
0.14.0
0.13.0
0.12.0
0.11.0
0.10.1
0.10.0
0.9.0
0.8.0
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.0
0.5.0
0.4.0
0.3.0
0.2.1
0.2.0
0.1.0
0.0.2
0.0.1
Vulnerabilities (4)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU118878 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\') CVE-2024-51999 |
CWE-1321 | Medium | 4.22.0, 5.1.0 | 01.12.2025 |
SB2025120158 |
||
| #VU97209 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2024-43796 |
CWE-79 | Medium | 4.20.0, 5.0.0 | 12.09.2024 |
SB2024091250 SB2024091251 SB2024091252 and 52 more |
||
| #VU88532 - URL Redirection to Untrusted Site ('Open Redirect') CVE-2024-29041 |
CWE-601 | Medium | 4.19.2, 5.0.0 beta.3 | 15.04.2024 |
SB2024041530 SB2024041532 SB2024042918 and 44 more |
||
| #VU69675 - Improper Control of Generation of Code ('Code Injection') CVE-2022-24999 |
CWE-94 | Medium | 4.17.3 | 29.11.2022 |
SB2022112910 SB2022112911 SB2022112943 and 49 more |