No Charset in Content-Type Header in express
GHSA-gpvr-g6gh-9mc2 · CVE-2014-6393
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.
Recommendation
For express 3.x, update express to version 3.11 or later.
For express 4.x, update express to version 4.5 or later.
Ready to move
Start Securing
Free, no credit card | First findings in minutes