# CVE-2024-9266: Express open redirect vulnerability

Source: https://junglewise.ai/threats/cve-2024-9266-express-open-redirect-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-9266 · Severity: low · CVSS 3.1 · Published 2024-10-03

Express is a popular web application framework for Node.js used to build web APIs and servers. This vulnerability allows attackers to redirect users to untrusted external websites through manipulated Express redirect responses, potentially leading to phishing attacks or credential theft if users are tricked into following malicious links.

Technologies: [Express](https://junglewise.ai/threats/technologies/npm-express).

## Quick answers

**Is CVE-2024-9266 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-9266 being exploited in the wild.

**How severe is CVE-2024-9266?** Low severity, with a CVSS score of 3.1, published 3 October 2024.

**Which products and versions are affected?** Express SEMVER:introduced=3.4.5,fixed=4.0.0-rc1.

**Is there a fix for CVE-2024-9266?** Yes. Express: upgrade to 4.0.0-rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-9266 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-9266?** Check whether you run Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Express: upgrade to 4.0.0-rc1 or later

## Technical details

This is a URL open redirect vulnerability (CWE-601) in the Express Response object's redirect handling logic. The vulnerability affects Express versions 3.4.5 through 4.0.0-rc1. An attacker can craft requests that cause the application to redirect users to arbitrary external URLs without proper validation. The attack requires user interaction (clicking a malicious link) but no authentication. The vulnerability is fixed in Express 4.0.0-rc1.

## Affected products

- Express Express 3.4.5 through 4.0.0-rc1

## Identifiers

- CVE-2024-9266
- GHSA-jj78-5fmv-mv28

## Timeline

- 2024-10-03: disclosed: GHSA-jj78-5fmv-mv28 published
- 2024-10-03: patched: Fixed in Express 4.0.0-rc1

## References

- [https://github.com/expressjs/express](https://github.com/expressjs/express)

## Related threats

- [Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability.](https://junglewise.ai/threats/cve-2024-51999-express-extended-query-parser-prototype-pollution)
- [Express resource injection in Link header](https://junglewise.ai/threats/cve-2024-10491-express-resource-injection-in-link-header)
- [Express XSS via response.redirect()](https://junglewise.ai/threats/cve-2024-43796-express-xss-via-response-redirect)
- [Express.js open redirect in malformed URLs](https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls)
- [Express missing charset in Content-Type header XSS](https://junglewise.ai/threats/cve-2014-6393-express-missing-charset-in-content-type-header-xss)