CVE-2024-43796 — Express open redirect

An open-redirect issue in Express's `res.location()` + `res.redirect()` let attacker-supplied input control the target of a redirect, enabling phishing campaigns that appear to originate from the trusted app.