pwnmyvibecode_

Express vulnerabilities and security advisories

The newest reviewed advisories for express, body-parser and multer on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when Express has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 21 · 12 critical, high or exploited

  • highSep 8, 2026

    multer vulnerable to Denial of Service via crafted multipart field names

    • multer < 2.3.0 · fixed in 2.3.0
    GHSA-wc9g-mqfw-jrwmCVE-2026-77078
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wc9g-mqfw-jrwm (CVE-2026-77078), severity high
What it is: multer vulnerable to Denial of Service via crafted multipart field names
Affected packages:
- multer: affected versions < 2.3.0. Fixed in 2.3.0.
Details: https://github.com/advisories/GHSA-wc9g-mqfw-jrwm

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highSep 8, 2026

    multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

    • multer = 2.2.0 · fixed in 2.3.0
    GHSA-qfvm-cv95-jqjfCVE-2026-77037
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-qfvm-cv95-jqjf (CVE-2026-77037), severity high
What it is: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Affected packages:
- multer: affected versions = 2.2.0. Fixed in 2.3.0.
Details: https://github.com/advisories/GHSA-qfvm-cv95-jqjf

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowSep 8, 2026

    multer vulnerable to file size limit bypass via async fileFilter race condition

    • multer < 2.3.0 · fixed in 2.3.0
    GHSA-qvfw-j98x-7q72CVE-2026-77063
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-qvfw-j98x-7q72 (CVE-2026-77063), severity low
What it is: multer vulnerable to file size limit bypass via async fileFilter race condition
Affected packages:
- multer: affected versions < 2.3.0. Fixed in 2.3.0.
Details: https://github.com/advisories/GHSA-qvfw-j98x-7q72

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highSep 8, 2026

    multer vulnerable to Denial of Service via oversized array index in field names

    • multer < 2.3.0 · fixed in 2.3.0
    GHSA-535w-7cp7-47q4CVE-2026-82333
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-535w-7cp7-47q4 (CVE-2026-82333), severity high
What it is: multer vulnerable to Denial of Service via oversized array index in field names
Affected packages:
- multer: affected versions < 2.3.0. Fixed in 2.3.0.
Details: https://github.com/advisories/GHSA-535w-7cp7-47q4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowJul 20, 2026

    body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

    • body-parser < 1.20.6 · fixed in 1.20.6
    • body-parser >= 2.0.0, < 2.3.0 · fixed in 2.3.0
    GHSA-v422-hmwv-36x6CVE-2026-12590
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-v422-hmwv-36x6 (CVE-2026-12590), severity low
What it is: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
Affected packages:
- body-parser: affected versions < 1.20.6. Fixed in 1.20.6.
- body-parser: affected versions >= 2.0.0, < 2.3.0. Fixed in 2.3.0.
Details: https://github.com/advisories/GHSA-v422-hmwv-36x6

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 17, 2026

    Multer vulnerable to Denial of Service via deeply nested field names

    • multer >= 1.0.0, < 2.2.0 · fixed in 2.2.0
    • multer >= 3.0.0-alpha.1, < 3.0.0-alpha.2 · fixed in 3.0.0-alpha.2
    GHSA-72gw-mp4g-v24jCVE-2026-5079
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-72gw-mp4g-v24j (CVE-2026-5079), severity high
What it is: Multer vulnerable to Denial of Service via deeply nested field names
Affected packages:
- multer: affected versions >= 1.0.0, < 2.2.0. Fixed in 2.2.0.
- multer: affected versions >= 3.0.0-alpha.1, < 3.0.0-alpha.2. Fixed in 3.0.0-alpha.2.
Details: https://github.com/advisories/GHSA-72gw-mp4g-v24j

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 17, 2026

    Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

    • multer >= 2.0.0-alpha.1, < 2.2.0 · fixed in 2.2.0
    • multer >= 3.0.0-alpha.1, < 3.0.0-alpha.2 · fixed in 3.0.0-alpha.2
    GHSA-3p4h-7m6x-2hcmCVE-2026-5038
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-3p4h-7m6x-2hcm (CVE-2026-5038), severity medium
What it is: Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Affected packages:
- multer: affected versions >= 2.0.0-alpha.1, < 2.2.0. Fixed in 2.2.0.
- multer: affected versions >= 3.0.0-alpha.1, < 3.0.0-alpha.2. Fixed in 3.0.0-alpha.2.
Details: https://github.com/advisories/GHSA-3p4h-7m6x-2hcm

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highMar 5, 2026

    Multer Vulnerable to Denial of Service via Uncontrolled Recursion

    • multer < 2.1.1 · fixed in 2.1.1
    GHSA-5528-5vmv-3xc2CVE-2026-3520
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-5528-5vmv-3xc2 (CVE-2026-3520), severity high
What it is: Multer Vulnerable to Denial of Service via Uncontrolled Recursion
Affected packages:
- multer: affected versions < 2.1.1. Fixed in 2.1.1.
Details: https://github.com/advisories/GHSA-5528-5vmv-3xc2

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highMar 1, 2026

    Multer vulnerable to Denial of Service via incomplete cleanup

    • multer < 2.1.0 · fixed in 2.1.0
    GHSA-xf7r-hgr6-v32pCVE-2026-3304
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-xf7r-hgr6-v32p (CVE-2026-3304), severity high
What it is: Multer vulnerable to Denial of Service via incomplete cleanup
Affected packages:
- multer: affected versions < 2.1.0. Fixed in 2.1.0.
Details: https://github.com/advisories/GHSA-xf7r-hgr6-v32p

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highMar 1, 2026

    Multer vulnerable to Denial of Service via resource exhaustion

    • multer < 2.1.0 · fixed in 2.1.0
    GHSA-v52c-386h-88mcCVE-2026-2359
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-v52c-386h-88mc (CVE-2026-2359), severity high
What it is: Multer vulnerable to Denial of Service via resource exhaustion
Affected packages:
- multer: affected versions < 2.1.0. Fixed in 2.1.0.
Details: https://github.com/advisories/GHSA-v52c-386h-88mc

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumNov 25, 2025

    body-parser is vulnerable to denial of service when url encoding is used

    • body-parser >= 2.2.0, < 2.2.1 · fixed in 2.2.1
    GHSA-wqch-xfxh-vrr4CVE-2025-13466
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wqch-xfxh-vrr4 (CVE-2025-13466), severity medium
What it is: body-parser is vulnerable to denial of service when url encoding is used
Affected packages:
- body-parser: affected versions >= 2.2.0, < 2.2.1. Fixed in 2.2.1.
Details: https://github.com/advisories/GHSA-wqch-xfxh-vrr4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJul 17, 2025

    Multer vulnerable to Denial of Service via unhandled exception from malformed request

    • multer >= 1.4.4-lts.1, < 2.0.2 · fixed in 2.0.2
    GHSA-fjgf-rc76-4x9pCVE-2025-7338
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-fjgf-rc76-4x9p (CVE-2025-7338), severity high
What it is: Multer vulnerable to Denial of Service via unhandled exception from malformed request
Affected packages:
- multer: affected versions >= 1.4.4-lts.1, < 2.0.2. Fixed in 2.0.2.
Details: https://github.com/advisories/GHSA-fjgf-rc76-4x9p

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 5, 2025

    Multer vulnerable to Denial of Service via unhandled exception

    • multer >= 1.4.4-lts.1, < 2.0.1 · fixed in 2.0.1
    GHSA-g5hg-p3ph-g8qgCVE-2025-48997
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-g5hg-p3ph-g8qg (CVE-2025-48997), severity high
What it is: Multer vulnerable to Denial of Service via unhandled exception
Affected packages:
- multer: affected versions >= 1.4.4-lts.1, < 2.0.1. Fixed in 2.0.1.
Details: https://github.com/advisories/GHSA-g5hg-p3ph-g8qg

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highMay 19, 2025

    Multer vulnerable to Denial of Service from maliciously crafted requests

    • multer >= 1.4.4-lts.1, < 2.0.0 · fixed in 2.0.0
    GHSA-4pg4-qvpc-4q3hCVE-2025-47944
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-4pg4-qvpc-4q3h (CVE-2025-47944), severity high
What it is: Multer vulnerable to Denial of Service from maliciously crafted requests
Affected packages:
- multer: affected versions >= 1.4.4-lts.1, < 2.0.0. Fixed in 2.0.0.
Details: https://github.com/advisories/GHSA-4pg4-qvpc-4q3h

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highMay 19, 2025

    Multer vulnerable to Denial of Service via memory leaks from unclosed streams

    • multer < 2.0.0 · fixed in 2.0.0
    GHSA-44fp-w29j-9vj5CVE-2025-47935
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-44fp-w29j-9vj5 (CVE-2025-47935), severity high
What it is: Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Affected packages:
- multer: affected versions < 2.0.0. Fixed in 2.0.0.
Details: https://github.com/advisories/GHSA-44fp-w29j-9vj5

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumOct 29, 2024

    Express ressource injection

    • express <= 3.21.4 · fixed in 4.0.0-rc1
    GHSA-cm5g-3pgc-8rg4CVE-2024-10491
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-cm5g-3pgc-8rg4 (CVE-2024-10491), severity medium
What it is: Express ressource injection
Affected packages:
- express: affected versions <= 3.21.4. Fixed in 4.0.0-rc1.
Details: https://github.com/advisories/GHSA-cm5g-3pgc-8rg4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowOct 3, 2024

    Express Open Redirect vulnerability

    • express >= 3.4.5, < 4.0.0-rc1 · fixed in 4.0.0-rc1
    GHSA-jj78-5fmv-mv28CVE-2024-9266
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-jj78-5fmv-mv28 (CVE-2024-9266), severity low
What it is: Express Open Redirect vulnerability
Affected packages:
- express: affected versions >= 3.4.5, < 4.0.0-rc1. Fixed in 4.0.0-rc1.
Details: https://github.com/advisories/GHSA-jj78-5fmv-mv28

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowSep 10, 2024

    express vulnerable to XSS via response.redirect()

    • express < 4.20.0 · fixed in 4.20.0
    • express >= 5.0.0-alpha.1, < 5.0.0 · fixed in 5.0.0
    GHSA-qw6h-vgh9-j6wxCVE-2024-43796
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-qw6h-vgh9-j6wx (CVE-2024-43796), severity low
What it is: express vulnerable to XSS via response.redirect()
Affected packages:
- express: affected versions < 4.20.0. Fixed in 4.20.0.
- express: affected versions >= 5.0.0-alpha.1, < 5.0.0. Fixed in 5.0.0.
Details: https://github.com/advisories/GHSA-qw6h-vgh9-j6wx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highSep 10, 2024

    body-parser vulnerable to denial of service when url encoding is enabled

    • body-parser < 1.20.3 · fixed in 1.20.3
    GHSA-qwcr-r2fm-qrc7CVE-2024-45590
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-qwcr-r2fm-qrc7 (CVE-2024-45590), severity high
What it is: body-parser vulnerable to denial of service when url encoding is enabled
Affected packages:
- body-parser: affected versions < 1.20.3. Fixed in 1.20.3.
Details: https://github.com/advisories/GHSA-qwcr-r2fm-qrc7

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumMar 25, 2024

    Express.js Open Redirect in malformed URLs

    • express < 4.19.2 · fixed in 4.19.2
    • express >= 5.0.0-alpha.1, < 5.0.0-beta.3 · fixed in 5.0.0-beta.3
    GHSA-rv95-896h-c2vcCVE-2024-29041
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-rv95-896h-c2vc (CVE-2024-29041), severity medium
What it is: Express.js Open Redirect in malformed URLs
Affected packages:
- express: affected versions < 4.19.2. Fixed in 4.19.2.
- express: affected versions >= 5.0.0-alpha.1, < 5.0.0-beta.3. Fixed in 5.0.0-beta.3.
Details: https://github.com/advisories/GHSA-rv95-896h-c2vc

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumOct 23, 2018

    No Charset in Content-Type Header in express

    • express < 3.11.0 · fixed in 3.11.0
    • express >= 4.0.0, < 4.5.0 · fixed in 4.5.0
    GHSA-gpvr-g6gh-9mc2CVE-2014-6393
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-gpvr-g6gh-9mc2 (CVE-2014-6393), severity medium
What it is: No Charset in Content-Type Header in express
Affected packages:
- express: affected versions < 3.11.0. Fixed in 3.11.0.
- express: affected versions >= 4.0.0, < 4.5.0. Fixed in 4.5.0.
Details: https://github.com/advisories/GHSA-gpvr-g6gh-9mc2

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping Express patched

  • npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
  • Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
  • A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.