cve 2024 29041

CVE-2024-29041 is an open redirect vulnerability in the Express.js web framework for Node.js. It allows attackers to bypass redirect allow-list checks by supplying malformed URLs that are improperly encoded or normalized by Express's res.location() and res.redirect() methods. Microsoft's advisory lists Azure Linux as a potentially affected product because it includes the vulnerable open-source library, but this does not guarantee that no other Microsoft products are affected. The vulnerability is not exclusive to Azure Linux; any product using the affected Express.js library could be at risk. Users should apply patches or mitigations as recommended by Express.js and Microsoft advisories.