Medium severity5.0NVD Advisory· Published Sep 10, 2024· Updated Jun 17, 2026
CVE-2024-43799
CVE-2024-43799
Description
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sendnpm | < 0.19.0 | 0.19.0 |
Affected products
59- osv-coords57 versionspkg:apk/chainguard/argo-workflow-clipkg:apk/chainguard/argo-workflow-controllerpkg:apk/chainguard/argo-workflow-controller-compatpkg:apk/chainguard/argo-workflow-executorpkg:apk/chainguard/argo-workflow-executor-compatpkg:apk/chainguard/argo-workflowspkg:apk/chainguard/argo-workflows-known-hostspkg:apk/chainguard/argo-workflows-uipkg:apk/chainguard/kubeflow-centraldashboardpkg:apk/chainguard/kubeflow-pipelinespkg:apk/chainguard/kubeflow-pipelines-apiserverpkg:apk/chainguard/kubeflow-pipelines-cache-deployerpkg:apk/chainguard/kubeflow-pipelines-cache-deployer-compatpkg:apk/chainguard/kubeflow-pipelines-cache_serverpkg:apk/chainguard/kubeflow-pipelines-frontendpkg:apk/chainguard/kubeflow-pipelines-metadata-envoy-configpkg:apk/chainguard/kubeflow-pipelines-metadata-writerpkg:apk/chainguard/kubeflow-pipelines-metadata-writer-compatpkg:apk/chainguard/kubeflow-pipelines-persistence_agentpkg:apk/chainguard/kubeflow-pipelines-scheduledworkflowpkg:apk/chainguard/kubeflow-pipelines-viewer-crd-controllerpkg:apk/chainguard/sqlpadpkg:apk/chainguard/sqlpad-compatpkg:apk/chainguard/thingsboardpkg:apk/chainguard/thingsboard-tb-js-executorpkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/chainguard/thingsboard-tb-web-uipkg:apk/wolfi/argo-workflow-clipkg:apk/wolfi/argo-workflow-controllerpkg:apk/wolfi/argo-workflow-controller-compatpkg:apk/wolfi/argo-workflow-executorpkg:apk/wolfi/argo-workflow-executor-compatpkg:apk/wolfi/argo-workflowspkg:apk/wolfi/argo-workflows-known-hostspkg:apk/wolfi/argo-workflows-uipkg:apk/wolfi/kubeflow-centraldashboardpkg:apk/wolfi/kubeflow-pipelinespkg:apk/wolfi/kubeflow-pipelines-apiserverpkg:apk/wolfi/kubeflow-pipelines-cache-deployerpkg:apk/wolfi/kubeflow-pipelines-cache-deployer-compatpkg:apk/wolfi/kubeflow-pipelines-cache_serverpkg:apk/wolfi/kubeflow-pipelines-frontendpkg:apk/wolfi/kubeflow-pipelines-metadata-envoy-configpkg:apk/wolfi/kubeflow-pipelines-metadata-writerpkg:apk/wolfi/kubeflow-pipelines-metadata-writer-compatpkg:apk/wolfi/kubeflow-pipelines-persistence_agentpkg:apk/wolfi/kubeflow-pipelines-scheduledworkflowpkg:apk/wolfi/kubeflow-pipelines-viewer-crd-controllerpkg:apk/wolfi/sqlpadpkg:apk/wolfi/sqlpad-compatpkg:apk/wolfi/thingsboardpkg:apk/wolfi/thingsboard-tb-js-executorpkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/wolfi/thingsboard-tb-nodepkg:apk/wolfi/thingsboard-tb-web-uipkg:npm/send
< 3.6.5-r2+ 56 more
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 1.9.0-r4
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 7.5.0-r1
- (no CPE)range: < 7.5.0-r1
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 3.6.5-r2
- (no CPE)range: < 1.9.0-r4
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 2.2.0-r12
- (no CPE)range: < 7.5.0-r1
- (no CPE)range: < 7.5.0-r1
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 3.7-r4
- (no CPE)range: < 0.19.0
- pillarjs/sendv5Range: < 0.19.0
Patches
Vulnerability mechanics
References
5- github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35nvdPatchWEB
- github.com/advisories/GHSA-m6fv-jmcg-4jfgghsaADVISORY
- github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfgnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-43799ghsaADVISORY
- lists.debian.org/debian-lts-announce/2025/06/msg00022.htmlnvdWEB
News mentions
0No linked articles in our index yet.