Medium severity4.7NVD Advisory· Published Oct 3, 2024· Updated Apr 15, 2026

CVE-2024-9266

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
expressnpm	>= 3.4.5, < 4.0.0-rc1	4.0.0-rc1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-jj78-5fmv-mv28ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-9266ghsaADVISORY
github.com/expressjs/express/compare/3.4.4...3.4.5ghsaWEB
www.herodevs.com/vulnerability-directory/cve-2024-9266nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000