CVE-2024-10491

What it actually does

The response.links function fails to sanitize Link header values, permitting sequences of ,, ;, and <> characters to inject arbitrary preload directives or other Link header entries when dynamic user-controlled data is supplied.

Why it matters to the business

Attackers can force browsers to preload or fetch attacker-chosen resources, increasing the risk of supply-chain or client-side attacks that may degrade user trust, trigger security alerts, or enable further compromise of end-user sessions.

How an attack unfolds

An attacker identifies a route that passes unsanitized query or body parameters into response.links, crafts a payload containing delimiter characters and a malicious URI, and triggers a response whose Link header now references attacker-controlled resources that the browser will preload.

How to fix it

Sanitize or validate all values passed to response.links, rejecting or encoding characters that can alter header structure (, ; <>). Prefer static Link headers or use a safe abstraction that does not accept raw user input. Monitor for future Express security releases addressing header construction.

How to confirm the fix worked

Review source code for direct use of response.links with request-derived data; test by sending crafted inputs and confirming the Link header remains unaltered; deploy automated header-sanitization tests in CI.

Typical attack path

1. Locate an Express endpoint that calls response.links with unsanitized input
2. Craft a payload containing ,, ;, and <> sequences that terminate the intended link value and inject a new preload directive
3. Submit the payload via GET/POST parameter or header
4. Inspect the resulting response Link header for the injected resource
5. Leverage the browser's automatic preload/fetch of the malicious target

How to detect it

Search web-server access logs and application logs for unusual Link header values containing multiple semicolons or angle brackets in responses; monitor for responses whose Link header contains URIs that do not match expected application assets.

What your security team should do

• Audit all calls to response.links and replace with safe header construction
• Add input validation rules that block header-relevant metacharacters
• Include Link header inspection in web-application firewall or proxy rules
• Track upstream Express releases for an official fix and apply promptly