CVE-2024-43796: Express.js RCE Vulnerability

CVE-2024-43796 Overview

CVE-2024-43796 is a cross-site scripting (XSS) vulnerability in Express.js, the minimalist web framework for Node.js. Versions of express prior to 4.20.0 render user-controlled input inside an anchor href attribute when applications pass that input to response.redirect(). Even after sanitization, the redirect target can carry payloads that execute in a victim's browser. The maintainers patched the flaw in express 4.20.0. The issue is tracked under [CWE-79] and affects both stable 4.x releases and the 5.0.0 alpha and beta lines.

Critical Impact
Attackers who influence redirect targets can trigger script execution in the victim's browser, enabling session theft, credential harvesting, and phishing pivots.

Affected Products

Express < 4.20.0 (Node.js)
Express 5.0.0-alpha.1 through 5.0.0-alpha.8
Express 5.0.0-beta.1 through 5.0.0-beta.3

Discovery Timeline

2024-09-10 - CVE-2024-43796 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43796

Vulnerability Analysis

Express exposes response.redirect(url) to send HTTP redirect responses. When the client accepts text/html, Express generates a small HTML body describing the redirect. Prior to 4.20.0, that HTML embedded the redirect URL twice: once as the href attribute of an anchor tag and once as its visible text. The URL was passed through escapeHtml(), which neutralizes characters like <, >, and ", but does not neutralize javascript: URI schemes or other constructs that remain valid inside an href. Attackers who control the redirect target can therefore inject an anchor pointing to a script URI. Users who click the redirect link execute attacker-controlled JavaScript in the application's origin.

Root Cause

The root cause is context-inappropriate output encoding. HTML entity escaping protects against tag injection but not against dangerous URI schemes rendered as link targets. Sanitizers that focus on script tags or HTML characters do not remove javascript:, data:, or vbscript: prefixes, so applications that trusted their input filters still passed exploitable strings to res.redirect().

Attack Vector

Exploitation requires user interaction. An attacker crafts a request that causes the application to call res.redirect() with a URL containing a script-executing scheme, then lures a victim to click the rendered link when the browser negotiates text/html. The scope-changed impact reflects that script execution occurs in the application's origin, enabling theft of session cookies and same-origin API abuse.

javascript

// Patch: lib/response.js — remove the anchor tag from the redirect body
     html: function(){
       var u = escapeHtml(address);
-      body = '<p>' + statuses.message[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
+      body = '<p>' + statuses.message[status] + '. Redirecting to ' + u + '</p>'
     },

     default: function(){
// Source: https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553

The patch removes the anchor element entirely from the HTML response body. The redirect target is still emitted as text but is no longer rendered as a clickable link, eliminating the script-URI execution path.

Detection Methods for CVE-2024-43796

Indicators of Compromise

HTTP 3xx responses whose bodies contain anchor tags with href="javascript:, href="data:, or other non-http(s) schemes
Application logs showing res.redirect() invocations with user-supplied query parameters, form values, or headers as arguments
Web server access logs containing URL-encoded javascript%3A or data%3A payloads in request parameters that feed redirect logic

Detection Strategies

Inventory Node.js services and identify express versions below 4.20.0 using npm ls express or SBOM tooling
Perform static analysis on application source to flag res.redirect(userInput) patterns where userInput derives from req.query, req.body, req.params, or req.headers
Deploy web application firewall rules that block requests carrying javascript: or data:text/html values in parameters destined for redirect endpoints

Monitoring Recommendations

Alert on outbound HTML responses containing anchor tags with non-standard URI schemes served by Express applications
Correlate user click telemetry with unusual same-origin script execution or cookie exfiltration attempts
Track dependency drift so newly deployed services do not reintroduce vulnerable express versions

How to Mitigate CVE-2024-43796

Immediate Actions Required

Upgrade express to 4.20.0 or later across all Node.js services and rebuild container images
Audit every call site of res.redirect() and validate that redirect targets are constrained to an allowlist of known-safe URLs or paths
Reject or normalize URLs whose scheme is not http or https before passing them to redirect helpers

Patch Information

The fix is available in express 4.20.0. The remediation commit is expressjs/express@54271f6, and the coordinated advisory is GHSA-qw6h-vgh9-j6wx. Applications on the Express 5 pre-release track should move to a fixed 5.x release once available; the alpha and beta versions listed above remain vulnerable.

Workarounds

Wrap res.redirect() in a helper that rejects any URL whose parsed scheme is not http or https
Serve redirects with Content-Type: text/plain or send a Location-only response to prevent the HTML body from being rendered
Enforce a strict Content Security Policy that forbids inline script execution and disallows javascript: navigation targets

bash

# Upgrade Express to the patched release
npm install express@^4.20.0
npm audit --production

# Verify no vulnerable versions remain in the dependency tree
npm ls express | grep -E 'express@(4\.(1?[0-9])\.|5\.0\.0-(alpha|beta))'