CVE-2024-10491

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
express	express	>= 3.0.0-alpha1, <= 3.21.2
expressjs	express	>= 3.0.0-alpha1, <= 3.21.2

References

https://www.herodevs.com/vulnerability-directory/cve-2024-10491Exploit, Third Party Advisory

Timeline

Published: Oct 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-104922.7A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the CVE-2024-104935.4The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 d CVE-2024-104947.8An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary c CVE-2024-104957.8An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or CVE-2024-104967.8An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in ar CVE-2024-104978.8CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outs CVE-2024-104986.5CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attac CVE-2024-104997.2The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a CVE-2024-10504.3The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit CVE-2024-105008.8A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is some unknown functionality of CVE-2024-105018.8A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function findById of the file /com/esafenet CVE-2024-105028.8A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of