CVE-2024-43799: Send Library RCE Vulnerability

CVE-2024-43799 Overview

CVE-2024-43799 affects the send library, a Node.js module for streaming files from the file system as an HTTP response. The vulnerability exists in the SendStream.redirect() function, which passes untrusted user input into HTML content without proper sanitization. An attacker can supply a crafted path that reflects into the generated redirect HTML document, resulting in a Cross-Site Scripting (XSS) condition [CWE-79]. The issue is patched in send version 0.19.0. The send library is a foundational dependency used by Express and other popular Node.js web frameworks, expanding the potential impact surface across the JavaScript ecosystem.

Critical Impact
Attackers can execute arbitrary script content in a victim's browser by inducing a request to a vulnerable endpoint that triggers the redirect handler.

Affected Products

send Node.js library versions prior to 0.19.0
Downstream frameworks bundling vulnerable send (including Express-based applications)
Debian LTS distributions shipping affected node-send packages

Discovery Timeline

2024-09-10 - CVE-2024-43799 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43799

Vulnerability Analysis

The vulnerability resides in the SendStream.redirect() method of the send library. When a directory request lacks a trailing slash, send generates a 301 redirect response with a small HTML body containing the target location. Prior to the fix, the redirect location was embedded twice: once inside an href attribute and once as visible link text. The embedded value derived from the request path, which is attacker-controlled.

Although the original code invoked escapeHtml() on the value, the interaction between URL encoding, HTML attribute context, and anchor rendering allowed crafted inputs to produce reflected content in the response body. A victim who follows an attacker-supplied link to a vulnerable endpoint receives an HTML document that reflects controlled input, enabling script execution in the origin's context.

Exploitation requires user interaction (UI:R) and a specific request shape, which reduces impact but does not eliminate risk for public-facing services.

Root Cause

The root cause is unsafe construction of an HTML redirect document from untrusted request path data [CWE-79]. The mitigation reduces the attack surface by removing the reflected anchor element and emitting only the escaped location as text, rather than rendering it as a clickable link inside an HTML page.

Attack Vector

An attacker crafts a URL targeting a directory-like path served by an application using vulnerable send. The victim clicks the link, the server responds with a 301 redirect page, and the malicious payload embedded in the path is reflected into the HTML response. The browser then parses and executes attacker-controlled markup in the origin's security context.

javascript

// Security patch in send/index.js (excerpt)
// Source: https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35

  var loc = encodeUrl(collapseLeadingSlashes(this.path + '/'))
- var doc = createHtmlDocument('Redirecting', 'Redirecting to <a href="' + escapeHtml(loc) + '">' +
-   escapeHtml(loc) + '</a>')
+ var doc = createHtmlDocument('Redirecting', 'Redirecting to ' + escapeHtml(loc))

  // redirect
  res.statusCode = 301

The patch removes the anchor element entirely and emits only the escaped location as text, closing the reflection path used by attackers.

Detection Methods for CVE-2024-43799

Indicators of Compromise

HTTP 301 responses from Node.js applications containing unexpected HTML characters or script fragments in the redirect body
Access log entries with unusual URL-encoded payloads targeting directory paths (for example, sequences containing %3C, %3E, javascript:)
Referrer chains showing users arriving at application endpoints from attacker-controlled domains

Detection Strategies

Perform a dependency inventory using npm ls send to identify direct and transitive usage of send versions below 0.19.0
Review Software Composition Analysis (SCA) reports for advisory GHSA-m6fv-jmcg-4jfg
Deploy web application firewall (WAF) signatures that inspect request paths for HTML metacharacters and script tokens

Monitoring Recommendations

Alert on outbound 301 responses whose bodies contain angle brackets or <script> markers
Correlate directory-listing requests with elevated error rates or anomalous user agents
Ingest Node.js application access logs into a centralized analytics platform to hunt for reflection patterns across services

How to Mitigate CVE-2024-43799

Immediate Actions Required

Upgrade send to version 0.19.0 or later in all Node.js applications
Update Express and other frameworks that transitively depend on send, then rebuild and redeploy affected services
Audit Debian LTS systems and apply the node-send package update referenced in the Debian LTS announcement

Patch Information

The fix landed in commit ae4f2989491b392ae2ef3b0015a019770ae65d35 and is released in send0.19.0. See the GitHub Security Advisory GHSA-m6fv-jmcg-4jfg and the upstream patch commit. Distribution-level fixes are documented in the Debian LTS Announcement.

Workarounds

Configure a reverse proxy to strip or normalize path components containing HTML metacharacters before requests reach the Node.js application
Set a strict Content-Security-Policy header that disallows inline scripts, reducing the impact of reflected payloads
Disable directory redirects in application routing until the dependency upgrade is deployed

bash

# Upgrade the send library and verify the installed version
npm install send@^0.19.0
npm ls send

# For Debian LTS systems
sudo apt-get update
sudo apt-get install --only-upgrade node-send