fix(deps): update dependency express to ~4.20.0 [security] - #33

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-express-vulnerability
Open

fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-express-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Mar 30, 2024•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence

Express.js Open Redirect in malformed URLs

CVE-2024-29041 / GHSA-rv95-896h-c2vc

More information

Details

Impact

Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.

When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.

The main method impacted is res.location() but this is also called from within res.redirect().

Patches

expressjs/express@0867302
expressjs/express@0b74695

An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.

Workarounds

The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.

Resources

https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

express vulnerable to XSS via response.redirect()

CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx

More information

Details

Impact

In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code

Patches

this issue is patched in express 4.20.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template

Severity

  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

expressjs/express (express)

v4.20.0

Compare Source

==========

  • deps: serve-static@​0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

==========

  • Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

==========

  • Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

==========

  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0

v4.18.3

Compare Source

==========

  • Fix routing requests without method
  • deps: body-parser@​1.20.2
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0
    • Add partitioned option

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovateBot requested a review from sullivanpj as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot requested a review from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud

sonarqubecloudBot commented Mar 30, 2024

Copy link
Copy Markdown

Quality Gate PassedQuality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@socket-security

socket-securityBot commented Mar 30, 2024•
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate
renovateBotforce-pushed the renovate/npm-express-vulnerability branch from 73dbdc9 to 07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot changed the title fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud

sonarqubecloudBot commented Sep 19, 2024

Copy link
Copy Markdown

Quality Gate PassedQuality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@renovate
renovateBotforce-pushed the renovate/npm-express-vulnerability branch from 07ee2f7 to 002e970CompareApril 15, 2026 16:05
@renovate
renovateBot requested a review from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed the renovate/npm-express-vulnerability branch from 002e970 to 9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed the renovate/npm-express-vulnerability branch from 9ec7e1f to f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed the renovate/npm-express-vulnerability branch from f3ea84e to 355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed the renovate/npm-express-vulnerability branch from 355d913 to 7fcf0c9CompareJune 13, 2026 03:51
@socket-security

socket-securityBot commented Jun 13, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100

View full report

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix(deps): update dependency express to ~4.20.0 [security] - #33
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Open
fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence
Express.js Open Redirect in malformed URLs
CVE-2024-29041 / GHSA-rv95-896h-c2vc
More information
Details
Impact
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.
When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.
The main method impacted is res.location() but this is also called from within res.redirect().
Patches
expressjs/express@0867302
expressjs/express@0b74695
An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.
Workarounds
The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.
Resources
https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
express vulnerable to XSS via response.redirect()
CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx
More information
Details
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template
Severity
  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/express (express)
v4.20.0
Compare Source
==========
  • deps: serve-static@​0.16.0

    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0

    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0

    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10

    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0

    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
v4.19.2
Compare Source
==========
  • Improved fix for open redirect allow list bypass
v4.19.1
Compare Source
==========
  • Allow passing non-strings to res.location with new encoding handling checks
v4.19.0
Compare Source
==========
  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0
v4.18.3
Compare Source
==========
  • Fix routing requests without method
  • deps: body-parser@​1.20.2

    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0

    • Add partitioned option
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot
requested a review
from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud
sonarqubecloudBot
commented
Mar 30, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
 No data about Coverage
0.0% Duplication on New Code
See analysis details on SonarCloud
@socket-security
socket-securityBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
73dbdc9 to
07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot
changed the title
fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud
sonarqubecloudBot
commented
Sep 19, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
07ee2f7 to
002e970CompareApril 15, 2026 16:05
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
002e970 to
9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
9ec7e1f to
f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
f3ea84e to
355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
355d913 to
7fcf0c9CompareJune 13, 2026 03:51
@socket-security
socket-securityBot
commented
Jun 13, 2026

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100
View full report
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to ~4.20.0 [security] - #33
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Open
fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence
Express.js Open Redirect in malformed URLs
CVE-2024-29041 / GHSA-rv95-896h-c2vc
More information
Details
Impact
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.
When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.
The main method impacted is res.location() but this is also called from within res.redirect().
Patches
expressjs/express@0867302
expressjs/express@0b74695
An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.
Workarounds
The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.
Resources
https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
express vulnerable to XSS via response.redirect()
CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx
More information
Details
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template
Severity
  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/express (express)
v4.20.0
Compare Source
==========
  • deps: serve-static@​0.16.0

    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0

    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0

    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10

    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0

    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
v4.19.2
Compare Source
==========
  • Improved fix for open redirect allow list bypass
v4.19.1
Compare Source
==========
  • Allow passing non-strings to res.location with new encoding handling checks
v4.19.0
Compare Source
==========
  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0
v4.18.3
Compare Source
==========
  • Fix routing requests without method
  • deps: body-parser@​1.20.2

    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0

    • Add partitioned option
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot
requested a review
from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud
sonarqubecloudBot
commented
Mar 30, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
 No data about Coverage
0.0% Duplication on New Code
See analysis details on SonarCloud
@socket-security
socket-securityBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
73dbdc9 to
07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot
changed the title
fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud
sonarqubecloudBot
commented
Sep 19, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
07ee2f7 to
002e970CompareApril 15, 2026 16:05
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
002e970 to
9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
9ec7e1f to
f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
f3ea84e to
355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
355d913 to
7fcf0c9CompareJune 13, 2026 03:51
@socket-security
socket-securityBot
commented
Jun 13, 2026

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100
View full report
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to ~4.20.0 [security] - #33
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Open
fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence
Express.js Open Redirect in malformed URLs
CVE-2024-29041 / GHSA-rv95-896h-c2vc
More information
Details
Impact
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.
When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.
The main method impacted is res.location() but this is also called from within res.redirect().
Patches
expressjs/express@0867302
expressjs/express@0b74695
An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.
Workarounds
The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.
Resources
https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
express vulnerable to XSS via response.redirect()
CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx
More information
Details
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template
Severity
  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/express (express)
v4.20.0
Compare Source
==========
  • deps: serve-static@​0.16.0

    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0

    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0

    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10

    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0

    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
v4.19.2
Compare Source
==========
  • Improved fix for open redirect allow list bypass
v4.19.1
Compare Source
==========
  • Allow passing non-strings to res.location with new encoding handling checks
v4.19.0
Compare Source
==========
  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0
v4.18.3
Compare Source
==========
  • Fix routing requests without method
  • deps: body-parser@​1.20.2

    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0

    • Add partitioned option
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot
requested a review
from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud
sonarqubecloudBot
commented
Mar 30, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
 No data about Coverage
0.0% Duplication on New Code
See analysis details on SonarCloud
@socket-security
socket-securityBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
73dbdc9 to
07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot
changed the title
fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud
sonarqubecloudBot
commented
Sep 19, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
07ee2f7 to
002e970CompareApril 15, 2026 16:05
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
002e970 to
9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
9ec7e1f to
f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
f3ea84e to
355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
355d913 to
7fcf0c9CompareJune 13, 2026 03:51
@socket-security
socket-securityBot
commented
Jun 13, 2026

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100
View full report
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix(deps): update dependency express to ~4.20.0 [security] - #33
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Open
fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence
Express.js Open Redirect in malformed URLs
CVE-2024-29041 / GHSA-rv95-896h-c2vc
More information
Details
Impact
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.
When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.
The main method impacted is res.location() but this is also called from within res.redirect().
Patches
expressjs/express@0867302
expressjs/express@0b74695
An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.
Workarounds
The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.
Resources
https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
express vulnerable to XSS via response.redirect()
CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx
More information
Details
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template
Severity
  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/express (express)
v4.20.0
Compare Source
==========
  • deps: serve-static@​0.16.0

    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0

    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0

    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10

    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0

    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
v4.19.2
Compare Source
==========
  • Improved fix for open redirect allow list bypass
v4.19.1
Compare Source
==========
  • Allow passing non-strings to res.location with new encoding handling checks
v4.19.0
Compare Source
==========
  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0
v4.18.3
Compare Source
==========
  • Fix routing requests without method
  • deps: body-parser@​1.20.2

    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0

    • Add partitioned option
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot
requested a review
from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud
sonarqubecloudBot
commented
Mar 30, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
 No data about Coverage
0.0% Duplication on New Code
See analysis details on SonarCloud
@socket-security
socket-securityBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
73dbdc9 to
07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot
changed the title
fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud
sonarqubecloudBot
commented
Sep 19, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
07ee2f7 to
002e970CompareApril 15, 2026 16:05
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
002e970 to
9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
9ec7e1f to
f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
f3ea84e to
355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
355d913 to
7fcf0c9CompareJune 13, 2026 03:51
@socket-security
socket-securityBot
commented
Jun 13, 2026

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100
View full report
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to ~4.20.0 [security] - #33
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Open
fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence
Express.js Open Redirect in malformed URLs
CVE-2024-29041 / GHSA-rv95-896h-c2vc
More information
Details
Impact
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.
When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.
The main method impacted is res.location() but this is also called from within res.redirect().
Patches
expressjs/express@0867302
expressjs/express@0b74695
An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.
Workarounds
The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.
Resources
https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
express vulnerable to XSS via response.redirect()
CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx
More information
Details
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template
Severity
  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/express (express)
v4.20.0
Compare Source
==========
  • deps: serve-static@​0.16.0

    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0

    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0

    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10

    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0

    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
v4.19.2
Compare Source
==========
  • Improved fix for open redirect allow list bypass
v4.19.1
Compare Source
==========
  • Allow passing non-strings to res.location with new encoding handling checks
v4.19.0
Compare Source
==========
  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0
v4.18.3
Compare Source
==========
  • Fix routing requests without method
  • deps: body-parser@​1.20.2

    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0

    • Add partitioned option
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot
requested a review
from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud
sonarqubecloudBot
commented
Mar 30, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
 No data about Coverage
0.0% Duplication on New Code
See analysis details on SonarCloud
@socket-security
socket-securityBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
73dbdc9 to
07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot
changed the title
fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud
sonarqubecloudBot
commented
Sep 19, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
07ee2f7 to
002e970CompareApril 15, 2026 16:05
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
002e970 to
9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
9ec7e1f to
f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
f3ea84e to
355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
355d913 to
7fcf0c9CompareJune 13, 2026 03:51
@socket-security
socket-securityBot
commented
Jun 13, 2026

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100
View full report
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(deps): update dependency express to ~4.20.0 [security] - #33
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Open
fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence
Express.js Open Redirect in malformed URLs
CVE-2024-29041 / GHSA-rv95-896h-c2vc
More information
Details
Impact
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.
When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.
The main method impacted is res.location() but this is also called from within res.redirect().
Patches
expressjs/express@0867302
expressjs/express@0b74695
An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.
Workarounds
The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.
Resources
https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
express vulnerable to XSS via response.redirect()
CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx
More information
Details
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template
Severity
  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/express (express)
v4.20.0
Compare Source
==========
  • deps: serve-static@​0.16.0

    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0

    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0

    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10

    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0

    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
v4.19.2
Compare Source
==========
  • Improved fix for open redirect allow list bypass
v4.19.1
Compare Source
==========
  • Allow passing non-strings to res.location with new encoding handling checks
v4.19.0
Compare Source
==========
  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0
v4.18.3
Compare Source
==========
  • Fix routing requests without method
  • deps: body-parser@​1.20.2

    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0

    • Add partitioned option
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot
requested a review
from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud
sonarqubecloudBot
commented
Mar 30, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
 No data about Coverage
0.0% Duplication on New Code
See analysis details on SonarCloud
@socket-security
socket-securityBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
73dbdc9 to
07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot
changed the title
fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud
sonarqubecloudBot
commented
Sep 19, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
07ee2f7 to
002e970CompareApril 15, 2026 16:05
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
002e970 to
9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
9ec7e1f to
f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
f3ea84e to
355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
355d913 to
7fcf0c9CompareJune 13, 2026 03:51
@socket-security
socket-securityBot
commented
Jun 13, 2026

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100
View full report
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix(deps): update dependency express to ~4.20.0 [security] - #33
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Open
fix(deps): update dependency express to ~4.20.0 [security]#33
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-express-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
express (source)~4.18.2 → ~4.20.0ageconfidence
Express.js Open Redirect in malformed URLs
CVE-2024-29041 / GHSA-rv95-896h-c2vc
More information
Details
Impact
Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.
When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.
The main method impacted is res.location() but this is also called from within res.redirect().
Patches
expressjs/express@0867302
expressjs/express@0b74695
An initial fix went out with express@4.19.0, we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.
Workarounds
The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.
Resources
https://github.com/expressjs/express/pull/5539
https://github.com/koajs/koa/issues/1800
https://expressjs.com/en/4x/api.html#res.location
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
express vulnerable to XSS via response.redirect()
CVE-2024-43796 / GHSA-qw6h-vgh9-j6wx
More information
Details
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code
Patches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template
Severity
  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/express (express)
v4.20.0
Compare Source
==========
  • deps: serve-static@​0.16.0

    • Remove link renderization in html while redirecting
  • deps: send@​0.19.0

    • Remove link renderization in html while redirecting
  • deps: body-parser@​0.6.0

    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@​0.1.10

    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0

    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
v4.19.2
Compare Source
==========
  • Improved fix for open redirect allow list bypass
v4.19.1
Compare Source
==========
  • Allow passing non-strings to res.location with new encoding handling checks
v4.19.0
Compare Source
==========
  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@​0.6.0
v4.18.3
Compare Source
==========
  • Fix routing requests without method
  • deps: body-parser@​1.20.2

    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@​2.5.2
  • deps: cookie@​0.6.0

    • Add partitioned option
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerMarch 30, 2024 05:54
@renovate
renovateBot
requested a review
from sullivanpjMarch 30, 2024 05:54
@sonarqubecloud
sonarqubecloudBot
commented
Mar 30, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
 No data about Coverage
0.0% Duplication on New Code
See analysis details on SonarCloud
@socket-security
socket-securityBot
commented
Mar 30, 2024•

edited

Loading

Copy link


Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
73dbdc9 to
07ee2f7CompareSeptember 19, 2024 20:34
@renovaterenovateBot
changed the title
fix(deps): update dependency express to ~4.19.0 [security]fix(deps): update dependency express to ~4.20.0 [security]Sep 19, 2024
@sonarqubecloud
sonarqubecloudBot
commented
Sep 19, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
07ee2f7 to
002e970CompareApril 15, 2026 16:05
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:05
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
002e970 to
9ec7e1fCompareApril 30, 2026 02:18
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
9ec7e1f to
f3ea84eCompareMay 22, 2026 08:15
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
f3ea84e to
355d913CompareMay 30, 2026 11:57
@renovate
renovateBotforce-pushed
the
renovate/npm-express-vulnerability
branch
from
355d913 to
7fcf0c9CompareJune 13, 2026 03:51
@socket-security
socket-securityBot
commented
Jun 13, 2026

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Addedexpress@​4.20.09710010091100
View full report
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants