{"schema_version":1,"title":"Express vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in Express: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2024-51999, was published on 1 December 2025.","url":"https://junglewise.ai/threats/technologies/npm-express","json_url":"https://junglewise.ai/threats/technologies/npm-express.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/npm-express","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":6,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":1},"latest":[{"cve":"CVE-2024-51999","cvss":4,"slug":"cve-2024-51999-express-extended-query-parser-prototype-pollution","title":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability.","severity":"medium","exploited":false,"published_at":"2025-12-01T21:15:49.1+00:00","url":"https://junglewise.ai/threats/cve-2024-51999-express-extended-query-parser-prototype-pollution"},{"cve":"CVE-2024-10491","cvss":3.1,"epss":0.0044,"slug":"cve-2024-10491-express-resource-injection-in-link-header","title":"Express resource injection in Link header","severity":"low","exploited":false,"published_at":"2024-10-29T18:30:37+00:00","url":"https://junglewise.ai/threats/cve-2024-10491-express-resource-injection-in-link-header"},{"cve":"CVE-2024-9266","cvss":3.1,"epss":0.0046,"slug":"cve-2024-9266-express-open-redirect-vulnerability","title":"Express open redirect vulnerability","severity":"low","exploited":false,"published_at":"2024-10-03T21:31:05+00:00","url":"https://junglewise.ai/threats/cve-2024-9266-express-open-redirect-vulnerability"},{"cve":"CVE-2024-43796","cvss":3.1,"epss":0.0049,"slug":"cve-2024-43796-express-xss-via-response-redirect","title":"Express XSS via response.redirect()","severity":"low","exploited":false,"published_at":"2024-09-10T19:41:04+00:00","url":"https://junglewise.ai/threats/cve-2024-43796-express-xss-via-response-redirect"},{"cve":"CVE-2024-29041","cvss":3.1,"epss":0.0079,"slug":"cve-2024-29041-express-js-open-redirect-in-malformed-urls","title":"Express.js open redirect in malformed URLs","severity":"low","exploited":false,"published_at":"2024-03-25T19:40:26+00:00","url":"https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls"},{"cve":"CVE-2014-6393","cvss":3,"epss":0.0114,"slug":"cve-2014-6393-express-missing-charset-in-content-type-header-xss","title":"Express missing charset in Content-Type header XSS","severity":"low","exploited":false,"published_at":"2018-10-23T17:22:54+00:00","url":"https://junglewise.ai/threats/cve-2014-6393-express-missing-charset-in-content-type-header-xss"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Express","slug":"npm-express","aliases":[],"category":"package","homepage":"https://expressjs.com","description":"Node.js web application server framework for building HTTP-based services.","url":"https://junglewise.ai/threats/technologies/npm-express"},"most_severe":[{"cve":"CVE-2024-51999","cvss":4,"slug":"cve-2024-51999-express-extended-query-parser-prototype-pollution","title":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability.","severity":"medium","exploited":false,"published_at":"2025-12-01T21:15:49.1+00:00","url":"https://junglewise.ai/threats/cve-2024-51999-express-extended-query-parser-prototype-pollution"},{"cve":"CVE-2024-29041","cvss":3.1,"epss":0.0079,"slug":"cve-2024-29041-express-js-open-redirect-in-malformed-urls","title":"Express.js open redirect in malformed URLs","severity":"low","exploited":false,"published_at":"2024-03-25T19:40:26+00:00","url":"https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls"},{"cve":"CVE-2024-43796","cvss":3.1,"epss":0.0049,"slug":"cve-2024-43796-express-xss-via-response-redirect","title":"Express XSS via response.redirect()","severity":"low","exploited":false,"published_at":"2024-09-10T19:41:04+00:00","url":"https://junglewise.ai/threats/cve-2024-43796-express-xss-via-response-redirect"},{"cve":"CVE-2024-9266","cvss":3.1,"epss":0.0046,"slug":"cve-2024-9266-express-open-redirect-vulnerability","title":"Express open redirect vulnerability","severity":"low","exploited":false,"published_at":"2024-10-03T21:31:05+00:00","url":"https://junglewise.ai/threats/cve-2024-9266-express-open-redirect-vulnerability"},{"cve":"CVE-2024-10491","cvss":3.1,"epss":0.0044,"slug":"cve-2024-10491-express-resource-injection-in-link-header","title":"Express resource injection in Link header","severity":"low","exploited":false,"published_at":"2024-10-29T18:30:37+00:00","url":"https://junglewise.ai/threats/cve-2024-10491-express-resource-injection-in-link-header"},{"cve":"CVE-2014-6393","cvss":3,"epss":0.0114,"slug":"cve-2014-6393-express-missing-charset-in-content-type-header-xss","title":"Express missing charset in Content-Type header XSS","severity":"low","exploited":false,"published_at":"2018-10-23T17:22:54+00:00","url":"https://junglewise.ai/threats/cve-2014-6393-express-missing-charset-in-content-type-header-xss"}],"generated_at":"2026-11-09T19:07:00.178973+00:00"}