Packages / serve / Security

HighVulnerabilityGHSA-48gc-5j93-5cfqPublished 11 Sep 2020

Path Traversal in serve

Affected releases · serve

  • 10.x10.0.0 – 10.1.1Fixed in 10.1.2
  • 9.x and older0.0.1 – 9.6.0No fix, no longer updated

On 10.x, the newest line:

npm install serve@10.1.2
14.x

  1. Not affected

    14.0.0 – 14.2.6

    12 releases, latest

10.x

  1. Affected

    10.0.0 – 10.1.1

    5 releases

  2. Fixed

    10.1.2

    1 release

9.x

  1. Affected

    9.0.0 – 9.6.0

    11 releases

8.x

  1. Affected

    8.0.0 – 8.2.0

    7 releases

7.x

  1. Affected

    7.0.0 – 7.2.0

    10 releases

6.x

  1. Affected

    6.0.0 – 6.5.8

    32 releases

5.x

  1. Affected

    5.0.0 – 5.2.4

    16 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    3 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    19 releases

2.x

  1. Affected

    2.0.0 – 2.4.4

    11 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    8 releases

0.x

  1. Affected

    0.0.1 – 0.0.5

    5 releases

155 stable releases of serve, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

What happens

Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.

Recommendation

Upgrade to version 10.1.2 or later.