XSS Attack with Express API

Description

XSS attack - anyone using the Express API is impacted

Recommendation

Update the eta package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-xrh7-m5pp-39r6
• CVE-2023-23630
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Injection in node-rules - CVE-2020-7609
• Command Injection in lodash - CVE-2021-23337
• gifplayer XSS vulnerability - CVE-2025-31128
• Prototype pollution in gsap - CVE-2020-28478

Tags:

npm

eta