{"schema_version":1,"title":"Express.js vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 14 vulnerabilities in Express.js: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111181, was published on 22 October 2026. 1 vulnerability in the last four weeks, level on the four before (1).","url":"https://junglewise.ai/threats/vendors/express-js","json_url":"https://junglewise.ai/threats/vendors/express-js.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/express-js","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":2,"all_time":14,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":4,"last_365_days":5},"latest":[{"cve":"CVE-2026-111181","cvss":7.5,"epss":0.0037,"slug":"cve-2026-111181-body-parser-is-body-parsing-middleware-for-node-js-and-express","title":"Express.js body-parser denial of service via decompression stream","severity":"high","exploited":false,"published_at":"2026-10-22T15:17:04.763+00:00","url":"https://junglewise.ai/threats/cve-2026-111181-body-parser-is-body-parsing-middleware-for-node-js-and-express"},{"cve":"CVE-2026-88932","cvss":5.3,"epss":0.0053,"slug":"cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes","title":"Express multer Denial of Service via orphaned disk writes","severity":"medium","exploited":false,"published_at":"2026-09-14T09:17:01.63+00:00","url":"https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes"},{"cve":"CVE-2026-77037","cvss":7.5,"epss":0.0058,"slug":"cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads","title":"Express multer file descriptor leak on aborted uploads","severity":"high","exploited":false,"published_at":"2026-08-28T22:16:53.627+00:00","url":"https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads"},{"cve":"CVE-2026-15603","cvss":5.3,"epss":0.0029,"slug":"cve-2026-15603-express-js-morgan-log-forging-via-unicode-line-separators","title":"Express.js morgan log forging via Unicode line separators","severity":"medium","exploited":false,"published_at":"2026-08-28T16:17:07.417+00:00","url":"https://junglewise.ai/threats/cve-2026-15603-express-js-morgan-log-forging-via-unicode-line-separators"},{"cve":"CVE-2025-13466","cvss":3.1,"epss":0.0037,"slug":"cve-2025-13466-body-parser-denial-of-service-in-url-encoding","title":"body-parser denial of service in URL encoding","severity":"low","exploited":false,"published_at":"2025-11-24T19:15:46.857+00:00","url":"https://junglewise.ai/threats/cve-2025-13466-body-parser-denial-of-service-in-url-encoding"},{"cve":"CVE-2025-48997","cvss":4,"epss":0.0044,"slug":"cve-2025-48997-multer-denial-of-service-via-unhandled-exception","title":"Multer Denial of Service via unhandled exception","severity":"medium","exploited":false,"published_at":"2025-06-05T01:09:35+00:00","url":"https://junglewise.ai/threats/cve-2025-48997-multer-denial-of-service-via-unhandled-exception"},{"cve":"CVE-2025-47935","cvss":3.1,"epss":0.0079,"slug":"cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams","title":"Multer memory leak denial of service via unclosed streams","severity":"low","exploited":false,"published_at":"2025-05-19T22:04:17+00:00","url":"https://junglewise.ai/threats/cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams"},{"cve":"CVE-2024-47178","cvss":3.1,"epss":0.0052,"slug":"cve-2024-47178-basic-auth-connect-timing-safe-string-comparison-in","title":"basic-auth-connect timing-safe string comparison in authentication","severity":"low","exploited":false,"published_at":"2024-09-30T17:48:29+00:00","url":"https://junglewise.ai/threats/cve-2024-47178-basic-auth-connect-timing-safe-string-comparison-in"},{"cve":"CVE-2024-43800","cvss":3.1,"epss":0.0063,"slug":"cve-2024-43800-serve-static-template-injection-leading-to-xss","title":"serve-static template injection leading to XSS","severity":"low","exploited":false,"published_at":"2024-09-10T19:42:33+00:00","url":"https://junglewise.ai/threats/cve-2024-43800-serve-static-template-injection-leading-to-xss"},{"cve":"CVE-2024-45590","cvss":3.1,"epss":0.0082,"slug":"cve-2024-45590-body-parser-denial-of-service-in-url-encoding","title":"body-parser denial of service in URL encoding","severity":"low","exploited":false,"published_at":"2024-09-10T15:52:39+00:00","url":"https://junglewise.ai/threats/cve-2024-45590-body-parser-denial-of-service-in-url-encoding"},{"cve":"CVE-2024-29041","cvss":3.1,"epss":0.0079,"slug":"cve-2024-29041-express-js-open-redirect-in-malformed-urls","title":"Express.js open redirect in malformed URLs","severity":"low","exploited":false,"published_at":"2024-03-25T19:40:26+00:00","url":"https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls"},{"cve":"CVE-2022-29623","cvss":3.1,"epss":0.013,"slug":"cve-2022-29623-connect-multiparty-arbitrary-file-upload","title":"Connect-Multiparty arbitrary file upload","severity":"low","exploited":false,"published_at":"2022-05-17T00:01:45+00:00","url":"https://junglewise.ai/threats/cve-2022-29623-connect-multiparty-arbitrary-file-upload"},{"cve":"CVE-2015-1164","cvss":3.1,"epss":0.0262,"slug":"cve-2015-1164-serve-static-open-redirect-vulnerability","title":"serve-static open redirect vulnerability","severity":"low","exploited":false,"published_at":"2020-08-31T22:57:02+00:00","url":"https://junglewise.ai/threats/cve-2015-1164-serve-static-open-redirect-vulnerability"},{"cve":"CVE-2017-16136","cvss":3,"epss":0.0122,"slug":"cve-2017-16136-method-override-redos-in-x-http-method-override-header","title":"method-override ReDoS in X-HTTP-Method-Override header","severity":"low","exploited":false,"published_at":"2018-07-24T20:06:04+00:00","url":"https://junglewise.ai/threats/cve-2017-16136-method-override-redos-in-x-http-method-override-header"}],"vendor":{"hub":true,"name":"Express.js","slug":"express-js","url":"https://junglewise.ai/threats/vendors/express-js"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-77037","cvss":7.5,"epss":0.0058,"slug":"cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads","title":"Express multer file descriptor leak on aborted uploads","severity":"high","exploited":false,"published_at":"2026-08-28T22:16:53.627+00:00","url":"https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads"},{"cve":"CVE-2026-111181","cvss":7.5,"epss":0.0037,"slug":"cve-2026-111181-body-parser-is-body-parsing-middleware-for-node-js-and-express","title":"Express.js body-parser denial of service via decompression stream","severity":"high","exploited":false,"published_at":"2026-10-22T15:17:04.763+00:00","url":"https://junglewise.ai/threats/cve-2026-111181-body-parser-is-body-parsing-middleware-for-node-js-and-express"},{"cve":"CVE-2026-88932","cvss":5.3,"epss":0.0053,"slug":"cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes","title":"Express multer Denial of Service via orphaned disk writes","severity":"medium","exploited":false,"published_at":"2026-09-14T09:17:01.63+00:00","url":"https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes"},{"cve":"CVE-2026-15603","cvss":5.3,"epss":0.0029,"slug":"cve-2026-15603-express-js-morgan-log-forging-via-unicode-line-separators","title":"Express.js morgan log forging via Unicode line separators","severity":"medium","exploited":false,"published_at":"2026-08-28T16:17:07.417+00:00","url":"https://junglewise.ai/threats/cve-2026-15603-express-js-morgan-log-forging-via-unicode-line-separators"},{"cve":"CVE-2025-48997","cvss":4,"epss":0.0044,"slug":"cve-2025-48997-multer-denial-of-service-via-unhandled-exception","title":"Multer Denial of Service via unhandled exception","severity":"medium","exploited":false,"published_at":"2025-06-05T01:09:35+00:00","url":"https://junglewise.ai/threats/cve-2025-48997-multer-denial-of-service-via-unhandled-exception"},{"cve":"CVE-2015-1164","cvss":3.1,"epss":0.0262,"slug":"cve-2015-1164-serve-static-open-redirect-vulnerability","title":"serve-static open redirect vulnerability","severity":"low","exploited":false,"published_at":"2020-08-31T22:57:02+00:00","url":"https://junglewise.ai/threats/cve-2015-1164-serve-static-open-redirect-vulnerability"},{"cve":"CVE-2022-29623","cvss":3.1,"epss":0.013,"slug":"cve-2022-29623-connect-multiparty-arbitrary-file-upload","title":"Connect-Multiparty arbitrary file upload","severity":"low","exploited":false,"published_at":"2022-05-17T00:01:45+00:00","url":"https://junglewise.ai/threats/cve-2022-29623-connect-multiparty-arbitrary-file-upload"},{"cve":"CVE-2024-45590","cvss":3.1,"epss":0.0082,"slug":"cve-2024-45590-body-parser-denial-of-service-in-url-encoding","title":"body-parser denial of service in URL encoding","severity":"low","exploited":false,"published_at":"2024-09-10T15:52:39+00:00","url":"https://junglewise.ai/threats/cve-2024-45590-body-parser-denial-of-service-in-url-encoding"},{"cve":"CVE-2025-47935","cvss":3.1,"epss":0.0079,"slug":"cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams","title":"Multer memory leak denial of service via unclosed streams","severity":"low","exploited":false,"published_at":"2025-05-19T22:04:17+00:00","url":"https://junglewise.ai/threats/cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams"},{"cve":"CVE-2024-29041","cvss":3.1,"epss":0.0079,"slug":"cve-2024-29041-express-js-open-redirect-in-malformed-urls","title":"Express.js open redirect in malformed URLs","severity":"low","exploited":false,"published_at":"2024-03-25T19:40:26+00:00","url":"https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[]}