CVE-2024-43799: Template Injection XSS in send package
Summary
CVE-2024-43799: send vulnerable to template injection that can lead to XSS. Affects send versions < 0.19.0. Fixed in 0.19.0. How to fix ↓
Also tracked for
- node-send · Debian:11
The same CVE-2024-43799 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The send package is an npm module used for serving static files in Node.js applications. It provides functionality to send files as responses to HTTP requests. The vulnerability in the send package allows for template injection, which can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises when untrusted user input is passed to the SendStream.redirect() function, even after sanitization. This can result in the execution of untrusted code. Successful exploitation of this vulnerability requires the following conditions: 1) The attacker must control the input to response.redirect(), 2) The express framework must not redirect before the template appears, and 3) The browser must not complete redirection before the user clicks on the link in the template. The impact of this vulnerability can lead to XSS attacks, compromising the security and integrity of the application.
How To Fix
Latest published version: 1.2.1 as of 22 Oct 2026
npm install send@1.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.19.0
This is the first release that contains the fix.
npm install send@0.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, users can implement a workaround by validating untrusted inputs against an explicit allowlist. This can be done by thoroughly checking and validating user input before passing it to response.redirect().
Conclusion
The send package is vulnerable to template injection, leading to potential XSS attacks. It is crucial to upgrade to version 0.19.0 or apply the recommended workarounds to mitigate the risk. Regularly updating packages and following secure coding practices can help maintain the security of Node.js applications.
See every vulnerability recorded for send →
FAQ
The vulnerability allows for template injection, which can lead to cross-site scripting (XSS) attacks. This can result in the execution of untrusted code and compromise the security of the application.
To fix this vulnerability, it is recommended to upgrade to version 0.19.0 of the send package. This version includes the necessary patches to mitigate the template injection XSS vulnerability.
Successful exploitation of this vulnerability requires the attacker to control the input to response.redirect(), the express framework not redirecting before the template appears, and the browser not completing redirection before the user clicks on the link in the template.
Yes, if upgrading to the patched version is not immediately feasible, users can implement a workaround by validating untrusted inputs against an explicit allowlist. This involves thoroughly checking and validating user input before passing it to response.redirect().
The CVSS score for this vulnerability is 5.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for send.
