express
v5.3.0Fast, unopinionated, minimalist web framework for node.
- Maintenance
- Active25 commits in 3 months · bus factor 1
- License
- MITPermissive · OSI-approved
- Security
- 3 advisories2 medium, 1 low · Scorecard 8.9/10
- Supported versions
- 2 lines supportednewest 5 · oldest 4 · 3 ended
69.7k stars · 25.5k forks · 259 open issues · last release 1 month ago · data checked 38 minutes ago
Security advisories
All advisories on GitHubThe 3 most recent advisories published by the maintainers: 2 medium, 1 low. Check the patched version against the one you run.
- lowCVE-2024-51999Dec 1, 2025REJECTED (not a vulnerability): improperly controlled modification of query properties in express
- Affected
- <4.22.0; <5.1.0
- Patched in
- 4.22.0; 5.1.0
- mediumCVE-2024-43796Sep 10, 2024express vulnerable to XSS via response.redirect()
- Affected
- <4.20.0; >=5.0.0-alpha.1, <5.0.0
- Patched in
- 4.20.0; 5.0.0
- mediumCVE-2024-29041Mar 25, 2024Express.js Open Redirect in malformed URLs
- Affected
- <4.19.2; >=5.0.0-alpha.1, <5.0.0-beta.3
- Patched in
- 4.19.2; 5.0.0-beta.3