expressjs vulnerabilities

CVEs per yearBy the year they were published

1. 20246
2. 20254
3. 20263

Newest CVEs

• CVE-2026-3520

  Multer vulnerable to Denial of Service via uncontrolled recursion

  expressjs · multer

  High8.7
• CVE-2026-3304

  Multer vulnerable to Denial of Service via incomplete cleanup

  expressjs · multer

  High8.7
• CVE-2026-2359

  Multer vulnerable to Denial of Service via resource exhaustion

  expressjs · multer

  High8.7
• CVE-2025-7338

  Multer vulnerable to Denial of Service via unhandled exception from malformed request

  expressjs · multer

  High7.5
• CVE-2025-48997

  Multer vulnerable to Denial of Service via unhandled exception

  expressjs · multer

  High8.7
• CVE-2025-47944

  Multer vulnerable to Denial of Service from maliciously crafted requests

  expressjs · multer

  High7.5
• CVE-2025-47935

  Multer vulnerable to Denial of Service via memory leaks from unclosed streams

  expressjs · multer

  High7.5
• CVE-2024-9266

  Open Redirect

  expressjs · express

  Medium4.7
• CVE-2024-47178

  basic-auth-connect's callback uses time unsafe string comparison

  expressjs · basic-auth-connect

  High8.7
• CVE-2024-45590

  body-parser vulnerable to denial of service when url encoding is enabled

  expressjs · body-parser

  High7.5