-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| express | npm | >= 3.4.5, < 4.0.0-rc1 | 4.0.0-rc1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Express's handling of the Location header via the Response.location() method. When a relative path starting with './' is provided from user input and the request path begins with '//', the URL resolution logic combines these to create a scheme-relative URL. This occurs because Express's resolve() method interprets './' in a way that collapses the path to a valid external redirect target. The HeroDevs reproduction and CVE description explicitly reference this behavior in the Response object, and the patched version (4.0.0-rc1) likely adds validation for Location header values.