VulnerableCode Package Details - pkg:npm/express@3.21.4

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/express@3.21.4

Essentials
History (1)

purl	pkg:npm/express@3.21.4
Tags	Ghost

Next non-vulnerable version	4.20.0
Latest non-vulnerable version	5.2.0
Risk	3.1

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-hyrv-e649-23fr Aliases: CVE-2024-10491 GHSA-cm5g-3pgc-8rg4	Express ressource injection A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.	4.0.0-rc1 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-07T04:56:18.596975+00:00	GHSA Importer	Affected by	VCID-hyrv-e649-23fr	https://github.com/advisories/GHSA-cm5g-3pgc-8rg4	38.1.0