{
  "cveId": "CVE-2024-10491",
  "url": "https://patchblox.com/security/cve/CVE-2024-10491",
  "summary": "CVE-2024-10491 is fixed in node-express on 1 platform, first by DEBIAN-CVE-2024-10491, released October 29, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "node-express: A vulnerability has been identified in the Express response.links\u00A0function, allowing for arbitrary resource injection...",
  "description": "A vulnerability has been identified in the Express response.links\u00A0function, allowing for arbitrary resource injection in the Link\u00A0header when unsanitized data is used.  The issue arises from improper sanitization in \u0060Link\u0060 header values, which can allow a combination of characters like \u0060,\u0060, \u0060;\u0060, and \u0060\u003C\u003E\u0060 to preload malicious resources.  This vulnerability is especially relevant for dynamic parameters.",
  "published": "2024-10-29T17:15:03Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss": 0.00441,
  "epssPercentile": 0.3856,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "4.1.1~dfsg-1",
      "fix": "DEBIAN-CVE-2024-10491",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-10491",
      "released": "2024-10-29T17:15:03Z"
    },
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "4.1.1~dfsg-1",
      "fix": "DEBIAN-CVE-2024-10491",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-10491",
      "released": "2024-10-29T17:15:03Z"
    },
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Debian 14",
      "fixedVersion": "4.1.1~dfsg-1",
      "fix": "DEBIAN-CVE-2024-10491",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-10491",
      "released": "2024-10-29T17:15:03Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}