# CVE-2024-10491: Express resource injection in Link header

Source: https://junglewise.ai/threats/cve-2024-10491-express-resource-injection-in-link-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-10491 · Severity: low · CVSS 3.1 · Published 2024-10-29

Express is a widely-used web application framework for Node.js that developers rely on to build and serve web applications. A vulnerability in Express's response.links function allows attackers to inject malicious resource references into HTTP Link headers by exploiting improper sanitization of dynamic parameters, potentially leading to malicious resource preloading and other header injection attacks.

Technologies: [Express](https://junglewise.ai/threats/technologies/npm-express).

## Quick answers

**Is CVE-2024-10491 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-10491 being exploited in the wild.

**How severe is CVE-2024-10491?** Low severity, with a CVSS score of 3.1, published 29 October 2024.

**Which products and versions are affected?** Express SEMVER:introduced=0,fixed=4.0.0-rc1.

**Is there a fix for CVE-2024-10491?** Yes. Express: upgrade to 4.0.0-rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-10491 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-10491?** Check whether you run Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Express: upgrade to 4.0.0-rc1 or later

## Technical details

The vulnerability is a resource injection flaw (CWE-74) in the Express response.links function, stemming from insufficient sanitization of Link header values. Attackers can craft input containing special characters (commas, semicolons, angle brackets) to inject arbitrary resources into the Link header when unsanitized user-controlled data is passed to the function. The attack requires no authentication and is remotely exploitable over the network, affecting all Express versions prior to 4.0.0-rc1. Successful exploitation allows preloading of malicious resources and potential header injection, though the CVSS score of 3.1 (later reported as 4.0 Medium) suggests limited direct impact in many configurations.

## Affected products

- Express Express <= 3.21.4

## Identifiers

- CVE-2024-10491
- GHSA-cm5g-3pgc-8rg4

## Timeline

- 2024-10-29: disclosed: Vulnerability published
- 2024-10-29: patched: Fix available in version 4.0.0-rc1

## References

- [https://github.com/expressjs/express/issues/6222](https://github.com/expressjs/express/issues/6222)

## Related threats

- [Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability.](https://junglewise.ai/threats/cve-2024-51999-express-extended-query-parser-prototype-pollution)
- [Express open redirect vulnerability](https://junglewise.ai/threats/cve-2024-9266-express-open-redirect-vulnerability)
- [Express XSS via response.redirect()](https://junglewise.ai/threats/cve-2024-43796-express-xss-via-response-redirect)
- [Express.js open redirect in malformed URLs](https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls)
- [Express missing charset in Content-Type header XSS](https://junglewise.ai/threats/cve-2014-6393-express-missing-charset-in-content-type-header-xss)