https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-06T17:30:19.437785+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2024-29041 CVE-2024-29041 — Express.js Open Redirect in malformed URLs 2026-11-06T17:30:19.460878+00:00

Affected: expressjs express

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

 https://db.gcve.eu/vuln/usn-7581-1 USN-7581-1 — node-express vulnerabilities 2026-11-06T17:30:19.461018+00:00

Affected: Ubuntu:Pro:16.04:LTS: node-express, Ubuntu:Pro:18.04:LTS: node-express, Ubuntu:Pro:20.04:LTS: node-express, Ubuntu:Pro:22.04:LTS: node-express, Ubuntu:Pro:24.04:LTS: node-express

It was discovered that Express incorrectly handled certain URLs, leading to an open redirect attack. A remote attacker could possibly use this issue to perform phishing attacks. (CVE-2024-29041)

Adam Korcz discovered that Express did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform cross site scripting. (CVE-2024-43796)