express (npm)
Fast, unopinionated, minimalist web framework for node.
Advisories
14
Latest version
5.3.0
Released Oct 9, 2026
License
MIT
OpenSSF Scorecard
8.5 / 10
How to fix
Upgrading to 5.0.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install express@5.3.0yarn
yarn add express@5.3.0pnpm
pnpm add express@5.3.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pj86-cfqh-vqx6 Withdrawn Advisory: express improperly controls modification of query properties Withdrawn |
Low | < 4.22.0 | 4.22.0 |
| GHSA-pj86-cfqh-vqx6 Withdrawn Advisory: express improperly controls modification of query properties Withdrawn |
Low | >= 5.0.0, < 5.2.0 | 5.2.0 |
| GHSA-pj86-cfqh-vqx6 Withdrawn Advisory: express improperly controls modification of query properties Withdrawn |
Low | < 4.22.0 | 4.22.0 |
| GHSA-pj86-cfqh-vqx6 Withdrawn Advisory: express improperly controls modification of query properties Withdrawn |
Low | >= 5.0.0, < 5.2.0 | 5.2.0 |
| GHSA-cm5g-3pgc-8rg4 Express ressource injection |
Medium EPSS 0.44% |
< 4.0.0-rc1 | 4.0.0-rc1 |
| GHSA-jj78-5fmv-mv28 Express Open Redirect vulnerability |
Medium EPSS 0.46% |
>= 3.4.5, < 4.0.0-rc1 | 4.0.0-rc1 |
| GHSA-qw6h-vgh9-j6wx express vulnerable to XSS via response.redirect() |
Medium EPSS 0.49% |
< 4.20.0 | 4.20.0 |
| GHSA-qw6h-vgh9-j6wx express vulnerable to XSS via response.redirect() |
Medium EPSS 0.49% |
>= 5.0.0-alpha.1, < 5.0.0 | 5.0.0 |
| GHSA-rv95-896h-c2vc Express.js Open Redirect in malformed URLs |
Medium EPSS 0.79% |
< 4.19.2 | 4.19.2 |
| GHSA-rv95-896h-c2vc Express.js Open Redirect in malformed URLs |
Medium EPSS 0.79% |
>= 5.0.0-alpha.1, < 5.0.0-beta.3 | 5.0.0-beta.3 |
| GHSA-rv95-896h-c2vc Express.js Open Redirect in malformed URLs |
Medium EPSS 0.79% |
>= 5.0.0-alpha.1, < 5.0.0-beta.3 | 5.0.0-beta.3 |
| GHSA-rv95-896h-c2vc Express.js Open Redirect in malformed URLs |
Medium EPSS 0.79% |
< 4.19.2 | 4.19.2 |
| GHSA-gpvr-g6gh-9mc2 No Charset in Content-Type Header in express |
Medium EPSS 1.14% |
< 3.11.0 | 3.11.0 |
| GHSA-gpvr-g6gh-9mc2 No Charset in Content-Type Header in express |
Medium EPSS 1.14% |
>= 4.0.0, < 4.5.0 | 4.5.0 |
Source: git+https://github.com/expressjs/express.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor