CVE-2024-29041: Express.js Open Redirect in malformed URLs

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-25 · updated 2026-06-17
Weakness: CWE-601

Description

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Affected products

expressjs express: before 4.19.2; 5.0.0-alpha1, 5.0.0-alpha2, 5.0.0-alpha3, 5.0.0-alpha4, 5.0.0-alpha5, 5.0.0-alpha6 (+4) — fixed in 4.19.2
Npm Express: before 4.19.2; from 5.0.0-alpha.1 before 5.0.0-beta.3 — fixed in 4.19.2, 5.0.0-beta.3

How to fix

Upgrade to a fixed version: expressjs express 4.19.2; Npm Express 4.19.2, 5.0.0-beta.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-29041 or the next vulnerability affects your stack