How severe is CVE-2024-29041?

CVE-2024-29041 has a CVSS score of 6.1/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by CVE-2024-29041?

CVE-2024-29041 affects the following packages: express (npm), express (npm). Ecosystems affected: npm.

How do I fix CVE-2024-29041?

Update express to 4.19.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-29041 is resolved across your whole dependency graph.

How do I detect CVE-2024-29041 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for express, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2024-29041 if there is no patch (or I can't update yet)?

Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.

Is CVE-2024-29041 actively exploited in the wild?

No public exploit code has been indexed for CVE-2024-29041 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2024-29041?

CVE-2024-29041 has an EPSS (Exploit Prediction Scoring System) score of 0.8%, placing it in the 56th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2024-29041?

CVE-2024-29041 is classified as Open Redirect (CWE-601), CWE-1286 (CWE-1286). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2024-29041 published, and has it been updated?

CVE-2024-29041 was published on March 25, 2024 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦

📦 npm

Not in CISA KEV

MEDIUM severity

CVE-2024-29041 — express

MEDIUMFix: expressjs/express@0867302

CVE-2024-29041 is a medium-severity (CVSS 6.1) Open Redirect vulnerability in express. A fix is available for express — see the affected versions and patch details below.

Express.js Open Redirect in malformed URLs

Also known asGHSA-rv95-896h-c2vc

Published

Mar 25, 2024

Updated

Oct 28, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-29041.

EPSS Exploitation Probability

via FIRST.org ↗

0.8%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs56th percentile — riskier than 56% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

109Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream

expressnpm

197.2Mdownloads / week

Description

Impact

Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs.

When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list.

The main method impacted is res.location() but this is also called from within res.redirect().

Patches

https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94

An initial fix went out with [email protected], we then patched a feature regression in 4.19.1 and added improved handling for the bypass in 4.19.2.

Workarounds

The fix for this involves pre-parsing the url string with either require('node:url').parse or new URL. These are steps you can take on your own before passing the user input string to res.location or res.redirect.

Resources

https://github.com/expressjs/express/pull/5539 https://github.com/koajs/koa/issues/1800 https://expressjs.com/en/4x/api.html#res.location

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`express`	all versions	4.19.2`npm install express@4.19.2`
📦npm	`express`	≥ 5.0.0-alpha.1&&< 5.0.0-beta.3	5.0.0-beta.3`npm install express@5.0.0-beta.3`

Affected Products

1 product · 11 configurations

Application

expressopenjsf

< 4.19.2

1 version

5.0.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for express, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update express to 4.19.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-29041 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

Red Hat Fuse 7 only uses express as part of build time development dependency, it is not part of the final product delivery. Upstream versions should not be relied upon for ultimate determination of affectedness. Red Hat might backport fixes from upstream versions on a case by case basis.

Workaround published by Red Hat

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Source: Red Hat security advisory for CVE-2024-29041 (CC BY 4.0)

Product	Fixed in	Advisory
NETWORK-OBSERVABILITY-1.6.0-RHEL-9	`network-observability/network-observability-cli-rhel9:v1.6.0-66`	RHSA-2024:3868
OpenShift-Pipelines-1.16-RHEL-8	`openshift-pipelines/pipelines-chains-controller-rhel8:v1.16.0-6`	RHEA-2024:7870
Red Hat build of Apicurio Registry 2.6.1 GA	`express`	RHSA-2024:4873
Red Hat Migration Toolkit for Containers 1.8	`rhmtc/openshift-migration-ui-rhel8:v1.8.4-10`	RHSA-2024:7164
Red Hat OpenShift Service Mesh 2.6 for RHEL 8	`openshift-service-mesh/grafana-rhel8:2.6.1-6`	RHSA-2024:6211
RHODF-4.14-RHEL-9	`odf4/mcg-core-rhel9:v4.14.11-1`	RHSA-2024:7624
RHODF-4.14-RHEL-9	`odf4/ocs-client-console-rhel9:v4.14.18-2`	RHSA-2025:8551
RHODF-4.15-RHEL-9	`odf4/ocs-client-console-rhel9:v4.15.14-2`	RHSA-2025:8544

Frequently Asked Questions

### Impact Versions of Express.js prior to 4.19.2 and pre-release alpha and beta versions before 5.0.0-beta.3 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented all