CVE-2024-43796 express vulnerable to XSS via response.redirect()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified for XSS Vulnerabilities in Jinja and Express CVE-2024-22195 was published on January 11, 2024, detailing a Cross-Site Scripting (XSS) vulnerability in Jinja. Additionally, CVE-2024-43796, published on September 10, 2024, describes an XSS vulnerability in Express via the response.redirect() method. Both vulnerabilities could potentially affect applications utilizing these frameworks. 2 sources 39