StackPrism

npm package

express vulnerabilities by version

The latest release, 5.3.0 (Oct 9, 2026), has no known vulnerabilities. 7% of last week’s 145.2M downloads went to versions with known vulnerabilities. OSV.dev lists 5 advisories for express; the newest was published on Oct 29, 2024.

npm (opens in a new tab) describes it as “Fast, unopinionated, minimalist web framework”

Latest release
5.3.0
Oct 9, 2026, no known vulnerabilities
Downloads last week
145.2M
All versions, from npm
Advisories on OSV.dev
5
Newest Oct 29, 2024
Licence
MIT
OpenSSF Scorecard
8.5/10
expressjs/express (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
5.2.1Dec 1, 2025No known vulnerabilities65M
4.22.3Sep 14, 2026No known vulnerabilities16.5M
4.22.2May 11, 2026No known vulnerabilities15.9M
4.22.1Dec 1, 2025No known vulnerabilities11.1M
5.1.0Mar 31, 2025No known vulnerabilities8.5M
5.3.0latestOct 9, 2026No known vulnerabilities7.8M
4.21.2Dec 5, 2024No known vulnerabilities7.7M
4.18.2Oct 8, 20222 known vulnerabilities, worst rated warning3.1M

Who is still on a vulnerable express

7% of last week’s 145.2M express downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

Support dates from endoflife.date (opens in a new tab). A line past its end date gets no more security fixes.

LineLatestSecurity support
55.3.0No end date announced
44.22.3No end date announced
33.21.2Ended Jul 5, 2015
22.5.11Ended Jul 1, 2012
11.0.9Ended Mar 1, 2011

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2024-10491 on OSV.dev (opens in a new tab)GHSA-cm5g-3pgc-8rg4

    Express ressource injection

    Affects < 4.0.0-rc1. Published Oct 29, 2024.

  2. LowCVE-2024-9266 on OSV.dev (opens in a new tab)GHSA-jj78-5fmv-mv28

    Express Open Redirect vulnerability

    Affects >= 3.4.5, < 4.0.0-rc1. Published Oct 3, 2024.

  3. LowCVE-2024-43796 on OSV.dev (opens in a new tab)GHSA-qw6h-vgh9-j6wx

    express vulnerable to XSS via response.redirect()

    Affects < 4.20.0; >= 5.0.0-alpha.1, < 5.0.0. Published Sep 10, 2024.

  4. WarningCVE-2024-29041 on OSV.dev (opens in a new tab)GHSA-rv95-896h-c2vc

    Express.js Open Redirect in malformed URLs

    Affects < 4.19.2; >= 5.0.0-alpha.1, < 5.0.0-beta.3. Published Mar 25, 2024.

  5. WarningCVE-2014-6393 on OSV.dev (opens in a new tab)GHSA-gpvr-g6gh-9mc2

    No Charset in Content-Type Header in express

    Affects < 3.11.0; >= 4.0.0, < 4.5.0. Published Oct 23, 2018.

Which express do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for express, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm, deps.dev and endoflife.date.