CVE-2024-29041: Express.js Open Redirect in malformed URLs
Summary
CVE-2024-29041: Express.js Open Redirect in malformed URLs. Affects express across 2 version ranges.
< 4.19.2
>= 5.0.0-alpha.1, < 5.0.0-beta.3
Fixed in 4.19.2 or 5.0.0-beta.3, depending on the release line you run. How to fix ↓
Also tracked for
- node-express · Debian:11
The same CVE-2024-29041 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Express.js is a popular web application framework for Node.js. It provides a robust set of features for building web applications and APIs. Express.js allows developers to handle routing, middleware, and other HTTP-related functionality easily. However, versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are vulnerable to an open redirect vulnerability using malformed URLs.
Vulnerability Detail
The vulnerability in Express.js occurs when a user performs a redirect using a user-provided URL. Express.js encodes the URL using encodeurl before passing it to the location header. This encoding can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main methods impacted are res.location() and res.redirect().
How To Fix
Latest published version: 5.3.0 as of 22 Oct 2026
npm install express@5.3.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.19.24.19.2npm install express@4.19.2 -
>= 5.0.0-alpha.1, < 5.0.0-beta.35.0.0-beta.3npm install express@5.0.0-beta.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Express.js is not immediately feasible, a workaround is to pre-parse the URL string using either require('node:url').parse or new URL before passing it to res.location() or res.redirect(). This will help mitigate the risk of the vulnerability.
Conclusion
In conclusion, the vulnerability in Express.js allows for an open redirect using malformed URLs. It is crucial to update to the latest version of Express.js (4.19.2 or later) to mitigate this vulnerability. If immediate updating is not possible, the recommended workaround should be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for express →
FAQ
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected.
The vulnerability allows for an open redirect, potentially leading to phishing attacks or other malicious activities.
Updating Express.js to version 4.19.2 or later will fix the vulnerability.
Yes, a workaround is to pre-parse the URL string using either require('node:url').parse or new URL before passing it to res.location() or res.redirect().
You can find more information in the Express.js documentation and the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for express.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
