expressjs / express

100%

master: 100%

LAST BUILD ON BRANCH fix/hostname-host-header-injection

branch: fix/hostname-host-header-injection

CHANGE BRANCH

x

Reset

• fix/hostname-host-header-injection
• #2729
• 4.13.4
• 4.14
• 4.14.0
• 4.14.1
• 4.15
• 4.15.0
• 4.15.1
• 4.15.2
• 4.15.3
• 4.15.4
• 4.15.5
• 4.16
• 4.16.0
• 4.16.1
• 4.16.2
• 4.16.3
• 4.16.4
• 4.17
• 4.17.0
• 4.17.1
• 4.18
• 4.18.3-staging
• 4.19.2-staging
• 4.x
• 4.x-query-range
• 5-merge
• 5.0
• 5.0.0-alpha.3
• 5.0.0-alpha.4
• 5.0.0-alpha.5
• 5.0.0-alpha.6
• 5.0.0-alpha.7
• 5.0.0-alpha.8
• 5.x
• accept-charsets
• actions-use-shas
• add-node-18-legacy
• add-tests-for-compileETag
• allow-ci-trigered-manually
• allow-to-use-multiple-pkg-manager
• async-view-resolve
• backport-ci-node-24
• be/improve-bugfix
• be/upgrade-content-disposition
• be/upgrade-content-type
• bjohansebas-patch-1
• bjohansebas-patch-2
• body-parser-2-1-0
• bsebas/check-first-referer
• bsebas/no-set-twice-content-type
• bsebas/nominate-to-murat
• bsebas/remove-benchmarks-dir
• build-node26
• bump/qs
• captain-wesleytodd
• charter
• chore/lookup
• chore/req-accepteLanguages
• ci
• ci-node-24
• ci-node-25
• ci-persist-credentials-false
• code-of-conduct
• codeql
• connection
• debug-v4
• dependabot/github_actions/actions/checkout-5.0.0
• dependabot/github_actions/actions/checkout-6.0.0
• dependabot/github_actions/actions/checkout-6.0.1
• dependabot/github_actions/actions/checkout-6.0.2
• dependabot/github_actions/actions/download-artifact-4.3.0
• dependabot/github_actions/actions/download-artifact-5.0.0
• dependabot/github_actions/actions/download-artifact-6.0.0
• dependabot/github_actions/actions/download-artifact-7.0.0
• dependabot/github_actions/actions/download-artifact-8.0.0
• dependabot/github_actions/actions/download-artifact-8.0.1
• dependabot/github_actions/actions/setup-node-4.4.0
• dependabot/github_actions/actions/setup-node-5.0.0
• dependabot/github_actions/actions/setup-node-6.0.0
• dependabot/github_actions/actions/setup-node-6.1.0
• dependabot/github_actions/actions/setup-node-6.2.0
• dependabot/github_actions/actions/setup-node-6.3.0
• dependabot/github_actions/actions/setup-node-6.4.0
• dependabot/github_actions/actions/upload-artifact-5.0.0
• dependabot/github_actions/actions/upload-artifact-6.0.0
• dependabot/github_actions/actions/upload-artifact-7.0.0
• dependabot/github_actions/actions/upload-artifact-7.0.1
• dependabot/github_actions/coverallsapp/github-action-2.3.7
• dependabot/github_actions/github/codeql-action-3.28.11
• dependabot/github_actions/github/codeql-action-3.28.13
• dependabot/github_actions/github/codeql-action-3.28.16
• dependabot/github_actions/github/codeql-action-3.28.18
• dependabot/github_actions/github/codeql-action-3.29.2
• dependabot/github_actions/github/codeql-action-3.29.5
• dependabot/github_actions/github/codeql-action-3.30.5
• dependabot/github_actions/github/codeql-action-4.31.2
• dependabot/github_actions/github/codeql-action-4.31.6
• dependabot/github_actions/github/codeql-action-4.31.9
• dependabot/github_actions/github/codeql-action-4.32.0
• dependabot/github_actions/github/codeql-action-4.32.4
• dependabot/github_actions/github/codeql-action-4.35.1
• dependabot/github_actions/github/codeql-action-4.35.2
• dependabot/github_actions/github/codeql-action-4.36.0
• dependabot/github_actions/ossf/scorecard-action-2.4.1
• dependabot/github_actions/ossf/scorecard-action-2.4.2
• dependabot/github_actions/ossf/scorecard-action-2.4.3
• dependabot/npm_and_yarn/cookie-session-2.1.0
• dependabot/npm_and_yarn/cookie-session-2.1.1
• dependabot/npm_and_yarn/hbs-4.2.1
• dependabot/npm_and_yarn/morgan-1.10.1
• deprecate-res.redirect(undefined)
• deps-body-parser-1.20.4
• deps-bumping-4.x
• deps/upgrade-ejs-4.0.1
• develop
• doc-release-process
• docs-https
• docs-readme-generator-security-link
• doug/4.14
• dp/semver-ranges
• drop_merge_descriptors
• dup-test
• duplicated-tests
• editorconfig-lint
• eslint-fix-flag
• eslint9
• ex-fixes
• explicitly-require-statement-buffer
• feat/explicit-error-code
• feature/native-env-file-support
• finalhandler-2-1-0
• fix-7147-query-array-limit
• fix-app-render-null-options
• fix-ci
• fix-ci-after-location-patch
• fix-ci-include-typo
• fix-dead-link
• fix-dependabot
• fix-error
• fix-query-array-limit
• fix-redis-example
• fix-static-tests-supertest-url-normalization
• fix-test-typo
• fix-vulnerabilities
• fix/7304-bump-qs-6.15.2
• fix/code-quality-improvements
• fix/content-type-false-value
• fix/cve-2026-2391-qs
• fix/error-logging
• fix/lib-qs
• fix/npm-install-docs-url
• fix/replace-module-parent-in-examples
• fix/sendstatus-bigint-error
• fix/status-code-bigint-error-message
• fix/trimright-to-trimend
• github-actions
• histnote5
• history-fix
• http2_support
• issue/5058
• jonchurch/fix-contributing-link
• juan/etag-plug
• makkuznetsov/update-path-regexp
• master
• master-fix/upgrade-mocha
• master-fix/upgrade-nyc
• master-fix/upgrade-supertest
• module_prefixes
• mv-types
• no-path-test
• no-store-no-etag
• node-protocol
• nominate-krzysdz
• on-finished
• on-finished-with-stream-finished
• patch-1
• patch-2
• prep/4.22.2
• qs-6-14-0
• qs-tilde
• query-range
• readme-guidelines
• refactor-res-download
• refactor/app-listen-slice
• refs/tags/4.17.2
• refs/tags/4.17.3
• refs/tags/4.18.0
• refs/tags/4.18.1
• refs/tags/4.18.2
• refs/tags/4.18.3
• refs/tags/4.19.1
• refs/tags/4.19.2
• refs/tags/5.0.0-beta.2
• refs/tags/v5.0.0-beta.1
• refs/tags/v5.0.0-beta.3
• release-branch-diagram
• release/4.21.3
• release/4.22.0
• release/4.22.1
• release/4.22.2
• release/5.1.0
• release/5.2.0
• release/5.2.1
• remove-documenation
• remove-editor-config
• remove-history-on-publish
• remove-utils-merge
• rename-variable
• render_async
• replace-methods
• replace-once
• repocaptians
• req.is
• res-header-issue
• res_format
• rewrite-ci
• rm-depd
• rm/add-rxmarbles
• rollback-cve-fix-4
• rollback-cve-fix-5
• router-2-1-0
• safe-npmrc
• shivarm-improve-error-message
• tc-gov
• tc-meetings
• test-1
• test/add-req-host-comma-separated-test
• test/add-req-host-ignore-comma-separated
• test/add-utils-normalizeType-fallback-test
• test/app‑listen‑signatures
• tests-no-headers-should
• throw-redirect
• tools/dependabot
• triage
• triage-edits
• tryRender_async_error
• ulises/body-parser
• ulises/router
• ulises/serve-static
• ulises/type-is
• ulises/upgrade-qs-in-4x
• update-badges
• update-ci
• update-example
• update-logo
• update-request-accepts-js-doc
• update-scorecard-actions
• update-send
• updates
• upgrade-body-parser
• url-redirect
• v4-store-settings
• validate-range-function
• warn-on-referrer
• wildcard_route

Build # 27593768251

Build Type

Pull #7317

github

Committed by web-flow

Commit Message

Merge f556b0b8d into 18e5985b8

Pull Request Pull Request #7317: fix: prevent host header injection by sanitizing userinfo in Host header

Coverage Stats

12 of 12 new or added lines in 1 file covered. (100.0%)

781 of 784 relevant lines covered (99.62%)

2581.81 hits per line