EX
Vendor
expressjs
14
CVEs
0
On KEV
0
New 30D
Products
MU7.5
multer
expressjs
9 CVEs0 on KEV0 new
BA5.3
Basic-auth-connect
Expressjs
1 CVEs0 on KEV0 new
BO7.5
body-parser
expressjs
1 CVEs0 on KEV0 new
EX4.7
express
expressjs
1 CVEs0 on KEV0 new
ME7.5
Method-override
Expressjs
1 CVEs0 on KEV0 new
SE4.7
serve-static
expressjs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82333 | MU Multer Expressjs | 7.5 | Aug 28 | multer vulnerable to Denial of Service via oversized array index in field names |
| CVE-2026-77078 | MU Multer Expressjs | 7.5 | Aug 28 | multer vulnerable to Denial of Service via crafted multipart field names |
| CVE-2026-77063 | MU Multer Expressjs | 3.7 | Aug 28 | multer vulnerable to file size limit bypass via async fileFilter race condition |
| CVE-2026-77037 | MU Multer Expressjs | 7.5 | Aug 28 | multer vulnerable to Denial of Service via file descriptor leak on aborted uploads |
| CVE-2026-5038 | MU Multer Expressjs | 7.5 | Jun 15 | multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads |
| CVE-2026-5079 | MU Multer Expressjs | 7.5 | Jun 15 | multer vulnerable to Denial of Service via deeply nested field names |
| CVE-2026-3520 | MU multer expressjs | 7.5 | Mar 4 | Multer vulnerable to Denial of Service via uncontrolled recursion |
| CVE-2026-3304 | MU multer expressjs | 7.5 | Feb 27 | Multer vulnerable to Denial of Service via incomplete cleanup |
| CVE-2026-2359 | MU multer expressjs | 7.5 | Feb 27 | Multer vulnerable to Denial of Service via resource exhaustion |
| CVE-2024-47178 | BA Basic-auth-connect Expressjs | 5.3 | Sep 30 | basic-auth-connect is Connect's Basic Auth middleware in its own module |
| CVE-2024-45590 | BO body-parser expressjs | 7.5 | Sep 10 | body-parser vulnerable to denial of service when url encoding is enabled |
| CVE-2024-43800 | SE serve-static expressjs | 4.7 | Sep 10 | serve-static affected by template injection that can lead to XSS |
| CVE-2024-43796 | EX express expressjs | 4.7 | Sep 10 | express vulnerable to XSS via response.redirect() |
| CVE-2017-16136 | ME Method-override Expressjs | 7.5 | Jun 7 | method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it |