Is express 3.2 vulnerable?

npm · 7 releases from 3.2.0 to 3.2.6 · latest express is 5.3.0 · checked 2 Nov 2026

Yes: 4 known advisories

Yes. express 3.2.6, the last 3.2 release, is affected by 4 known security advisories (3 medium, 1 low), including CVE-2024-10491, CVE-2024-29041, CVE-2014-6393. Upgrade to 4.20.0 or later to fix all of them.

Upgrade with:npm install express@4.20.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting express 3.2.6

  • MediumCVE-2024-10491GHSA-cm5g-3pgc-8rg429 Oct 2024

    Express ressource injection

    Affected
    <4.0.0-rc1
    Fixed in
    4.0.0-rc1
  • LowCVE-2024-43796GHSA-qw6h-vgh9-j6wx10 Sept 2024

    express vulnerable to XSS via response.redirect()

    Affected
    <4.20.0 · >=5.0.0-alpha.1 <5.0.0
    Fixed in
    4.20.0, 5.0.0
  • MediumCVE-2024-29041GHSA-rv95-896h-c2vc25 Mar 2024

    Express.js Open Redirect in malformed URLs

    Affected
    <4.19.2 · >=5.0.0-alpha.1 <5.0.0-beta.3
    Fixed in
    4.19.2, 5.0.0-beta.3
  • MediumCVE-2014-6393GHSA-gpvr-g6gh-9mc223 Oct 2018

    No Charset in Content-Type Header in express

    Affected
    <3.11.0 · >=4.0.0 <4.5.0
    Fixed in
    3.11.0, 4.5.0

Which of your client projects are still on express 3.2?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact express version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other express versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.