CVE catalog
CVE-2024-9266
node-express: CVE-2024-9266
- Severity
- Medium · CVSS 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.46% · Oct 25, 2026
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-express | sid | 5.2.1+~cs12.3.9-1 | not affected |
| Debian | node-express | forky | 5.2.1+~cs12.3.9-1 | not affected |
| Debian | node-express | trixie | 4.21.2+~cs8.36.27-2 | not affected |
| Debian | node-express | bookworm | 4.18.2+~4.17.14-1 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-express | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | node-express | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | node-express | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | node-express | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-express]Not affected
Details (2)
4.18.2+~4.17.14-1· all · bookwormNot affected
dsa · node-express · debian · bookworm
4.18.2+~4.17.14-1· all · bookwormNot affected
dsa · node-express · debian · bookworm
Observed: