CVE-2024-43799: send vulnerable to template injection that can lead to XSS

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-10 · updated 2026-06-17
Weakness: CWE-79

Description

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

Affected products

pillarjs send: before 0.19.0 — fixed in 0.19.0
Npm Send: before 0.19.0 — fixed in 0.19.0

How to fix

Upgrade to a fixed version: pillarjs send 0.19.0; Npm Send 0.19.0. Check the vendor advisory for mitigations.

References

https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35
https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg
https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html

Get alerted when CVE-2024-43799 or the next vulnerability affects your stack