CVE-2024-43799 is a vulnerability in the 'send' package before version 0.19.0 where passing untrusted user input to SendStream.redirect() can lead to template injection and potential cross-site scripting (XSS). Exploitation requires attacker control of the redirect input, no premature redirection by express, and user interaction with a link in the template. The issue is patched in version 0.19.0.