CVE-2024-9266

A flaw was found in the Express package for Node.js. Certain versions are vulnerable to an open redirect attack, a URL redirection to an untrusted site, via the Express 3 Response object. This flaw may allow a user to be redirected to an untrusted page containing malware, which may compromise the user's machine.

This flaw is specific to certain versions of Express 3, which has reached end-of-life. No Red Hat products are affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.