Packages / serve / Security

ModerateVulnerabilityGHSA-5rc4-8qqh-vq7fCVE-2018-3718Published 9 Aug 2021

vercel/serve allows access to restricted files if filename is URL encoded.

Affected releases · serve

  • 6.x6.0.0 – 6.5.1Fixed in 6.5.2
  • 5.x and older0.0.1 – 5.2.4No fix, no longer updated

On 6.x, the newest line:

npm install serve@6.5.2
14.x

  1. Not affected

    14.0.0 – 14.2.6

    12 releases, latest

6.x

  1. Affected

    6.0.0 – 6.5.1

    25 releases

  2. Fixed

    6.5.2 – 6.5.8

    7 releases

5.x

  1. Affected

    5.0.0 – 5.2.4

    16 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    3 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    19 releases

2.x

  1. Affected

    2.0.0 – 2.4.4

    11 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    8 releases

0.x

  1. Affected

    0.0.1 – 0.0.5

    5 releases

155 stable releases of serve, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

What happens

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.