# Express.js vulnerabilities Source: https://junglewise.ai/threats/vendors/express-js Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/express-js.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Express.js: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111181, was published on 22 October 2026. 1 vulnerability in the last four weeks, level on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 4 - All time: 14 (0 critical, 0 exploited in the wild) ## Latest Express.js vulnerabilities - [CVE-2026-111181: Express.js body-parser denial of service via decompression stream](https://junglewise.ai/threats/cve-2026-111181-body-parser-is-body-parsing-middleware-for-node-js-and-express) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-88932: Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-77037: Express multer file descriptor leak on aborted uploads](https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-15603: Express.js morgan log forging via Unicode line separators](https://junglewise.ai/threats/cve-2026-15603-express-js-morgan-log-forging-via-unicode-line-separators) (medium, CVSS 5.3, published 28 Aug 2026) - [CVE-2025-13466: body-parser denial of service in URL encoding](https://junglewise.ai/threats/cve-2025-13466-body-parser-denial-of-service-in-url-encoding) (low, CVSS 3.1, published 24 Nov 2025) - [CVE-2025-48997: Multer Denial of Service via unhandled exception](https://junglewise.ai/threats/cve-2025-48997-multer-denial-of-service-via-unhandled-exception) (medium, CVSS 4, published 5 Jun 2025) - [CVE-2025-47935: Multer memory leak denial of service via unclosed streams](https://junglewise.ai/threats/cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams) (low, CVSS 3.1, published 19 May 2025) - [CVE-2024-47178: basic-auth-connect timing-safe string comparison in authentication](https://junglewise.ai/threats/cve-2024-47178-basic-auth-connect-timing-safe-string-comparison-in) (low, CVSS 3.1, published 30 Sep 2024) - [CVE-2024-43800: serve-static template injection leading to XSS](https://junglewise.ai/threats/cve-2024-43800-serve-static-template-injection-leading-to-xss) (low, CVSS 3.1, published 10 Sep 2024) - [CVE-2024-45590: body-parser denial of service in URL encoding](https://junglewise.ai/threats/cve-2024-45590-body-parser-denial-of-service-in-url-encoding) (low, CVSS 3.1, published 10 Sep 2024) - [CVE-2024-29041: Express.js open redirect in malformed URLs](https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls) (low, CVSS 3.1, published 25 Mar 2024) - [CVE-2022-29623: Connect-Multiparty arbitrary file upload](https://junglewise.ai/threats/cve-2022-29623-connect-multiparty-arbitrary-file-upload) (low, CVSS 3.1, published 17 May 2022) - [CVE-2015-1164: serve-static open redirect vulnerability](https://junglewise.ai/threats/cve-2015-1164-serve-static-open-redirect-vulnerability) (low, CVSS 3.1, published 31 Aug 2020) - [CVE-2017-16136: method-override ReDoS in X-HTTP-Method-Override header](https://junglewise.ai/threats/cve-2017-16136-method-override-redos-in-x-http-method-override-header) (low, CVSS 3, published 24 Jul 2018) ## Most severe Express.js vulnerabilities - [CVE-2026-77037: Express multer file descriptor leak on aborted uploads](https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-111181: Express.js body-parser denial of service via decompression stream](https://junglewise.ai/threats/cve-2026-111181-body-parser-is-body-parsing-middleware-for-node-js-and-express) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-88932: Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-15603: Express.js morgan log forging via Unicode line separators](https://junglewise.ai/threats/cve-2026-15603-express-js-morgan-log-forging-via-unicode-line-separators) (medium, CVSS 5.3, published 28 Aug 2026) - [CVE-2025-48997: Multer Denial of Service via unhandled exception](https://junglewise.ai/threats/cve-2025-48997-multer-denial-of-service-via-unhandled-exception) (medium, CVSS 4, published 5 Jun 2025) - [CVE-2015-1164: serve-static open redirect vulnerability](https://junglewise.ai/threats/cve-2015-1164-serve-static-open-redirect-vulnerability) (low, CVSS 3.1, published 31 Aug 2020) - [CVE-2022-29623: Connect-Multiparty arbitrary file upload](https://junglewise.ai/threats/cve-2022-29623-connect-multiparty-arbitrary-file-upload) (low, CVSS 3.1, published 17 May 2022) - [CVE-2024-45590: body-parser denial of service in URL encoding](https://junglewise.ai/threats/cve-2024-45590-body-parser-denial-of-service-in-url-encoding) (low, CVSS 3.1, published 10 Sep 2024) - [CVE-2025-47935: Multer memory leak denial of service via unclosed streams](https://junglewise.ai/threats/cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams) (low, CVSS 3.1, published 19 May 2025) - [CVE-2024-29041: Express.js open redirect in malformed URLs](https://junglewise.ai/threats/cve-2024-29041-express-js-open-redirect-in-malformed-urls) (low, CVSS 3.1, published 25 Mar 2024) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Express.js vulnerabilities", https://junglewise.ai/threats/vendors/express-js, 9 November 2026.