Skip to content

Commit f3b92d9

Browse files
authored
docs: update security updates documentation for Express (#1800)
1 parent 7f9b0d8 commit f3b92d9

File tree

1 file changed

+20
-2
lines changed

1 file changed

+20
-2
lines changed

en/advanced/security-updates.md

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,29 @@ Node.js vulnerabilities directly affect Express. Therefore, [keep a watch on Nod
1515

1616
The list below enumerates the Express vulnerabilities that were fixed in the specified version update.
1717

18-
**NOTE**: If you believe you have discovered a security vulnerability in Express, please see
18+
19+
{% capture security-policy %}
20+
If you believe you have discovered a security vulnerability in Express, please see
1921
[Security Policies and Procedures](/{{page.lang}}/resources/contributing.html#security-policies-and-procedures).
22+
{% endcapture %}
2023

21-
## 4.x
24+
{% include admonitions/note.html content=security-policy %}
2225

26+
## 4.x
27+
* 4.21.2
28+
* The dependency `path-to-regexp` has been updated to address a [vulnerability](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w).
29+
* 4.21.1
30+
* The dependency `cookie` has been updated to address a [vulnerability](https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x), This may affect your application if you use `res.cookie`.
31+
* 4.20.0
32+
* Fixed XSS vulnerability in `res.redirect` ([advisory](https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx), [CVE-2024-43796](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43796)).
33+
* The dependency `serve-static` has been updated to address a [vulnerability](https://github.com/advisories/GHSA-cm22-4g7w-348p).
34+
* The dependency `send` has been updated to address a [vulnerability](https://github.com/advisories/GHSA-m6fv-jmcg-4jfg).
35+
* The dependency `path-to-regexp` has been updated to address a [vulnerability](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j).
36+
* The dependency `body-parser` has been updated to addres a [vulnerability](https://github.com/advisories/GHSA-qwcr-r2fm-qrc7), This may affect your application if you had url enconding activated.
37+
* 4.19.0, 4.19.1
38+
* Fixed open redirect vulnerability in `res.location` and `res.redirect` ([advisory](https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc), [CVE-2024-29041](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29041)).
39+
* 4.17.3
40+
* The dependency `qs` has been updated to address a [vulnerability](https://github.com/advisories/GHSA-hrpp-h998-j3pp). This may affect your application if the following APIs are used: `req.query`, `req.body`, `req.param`.
2341
* 4.16.0
2442
* The dependency `forwarded` has been updated to address a [vulnerability](https://npmjs.com/advisories/527). This may affect your application if the following APIs are used: `req.host`, `req.hostname`, `req.ip`, `req.ips`, `req.protocol`.
2543
* The dependency `mime` has been updated to address a [vulnerability](https://npmjs.com/advisories/535), but this issue does not impact Express.

0 commit comments

Comments
 (0)