[Pkg-javascript-devel] Bug#1088807: node-express: CVE-2024-10491

[Moritz Mühlenhoff]

Source: node-express
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for node-express.

CVE-2024-10491[0]:
| A vulnerability has been identified in the Express
| response.links function, allowing for arbitrary resource injection
| in the Link header when unsanitized data is used.  The issue arises
| from improper sanitization in `Link` header values, which can allow
| a combination of characters like `,`, `;`, and `<>` to preload
| malicious resources.  This vulnerability is especially relevant for
| dynamic parameters.

https://www.herodevs.com/vulnerability-directory/cve-2024-10491


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-10491
    https://www.cve.org/CVERecord?id=CVE-2024-10491

Please adjust the affected versions in the BTS as needed.