{
  "cveId": "CVE-2024-29041",
  "url": "https://patchblox.com/security/cve/CVE-2024-29041",
  "summary": "CVE-2024-29041 is fixed in node-express on 1 platform, first by DEBIAN-CVE-2024-29041, released March 25, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "node-express: Express.js minimalist web framework for node",
  "description": "Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using \u0060encodeurl\u0060](https://github.com/pillarjs/encodeurl) on the contents before passing it to the \u0060location\u0060 header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is \u0060res.location()\u0060 but this is also called from within \u0060res.redirect()\u0060. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.",
  "published": "2024-03-25T14:15:00Z",
  "severity": "medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.00786,
  "epssPercentile": 0.56369,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "4.19.2\u002B~cs8.36.21-1",
      "fix": "DEBIAN-CVE-2024-29041",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-29041",
      "released": "2024-03-25T21:15:46Z"
    },
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Debian 14",
      "fixedVersion": "4.19.2\u002B~cs8.36.21-1",
      "fix": "DEBIAN-CVE-2024-29041",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-29041",
      "released": "2024-03-25T21:15:46Z"
    },
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "4.1.1~dfsg-1ubuntu0.18.04.1~esm1",
      "fix": "node-express 4.1.1~dfsg-1ubuntu0.18.04.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-node-express-4.1.1-dfsg-1ubuntu0.18.04.1-esm1",
      "released": "2024-09-10T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "4.17.1-2ubuntu0.1~esm1",
      "fix": "node-express 4.17.1-2ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-node-express-4.17.1-2ubuntu0.1-esm1",
      "released": "2024-09-10T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "node-express",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "4.17.3\u002B~4.17.13-1ubuntu0.1~esm1",
      "fix": "node-express 4.17.3\u002B~4.17.13-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-node-express-4.17.3-4.17.13-1ubuntu0.1-esm1",
      "released": "2024-09-10T08:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}