Packages / serve / Security

ModerateVulnerabilityGHSA-686g-3xr3-x4x6CVE-2018-3809Published 18 Jul 2018

Information Exposure on Case Insensitive File Systems in serve

Affected releases · serve

  • 6.x and older0.0.1 – 6.5.8No fix, no longer updated

6.x has no fix yet; the newest fixed line:

npm install serve@7.0.0
14.x

  1. Not affected

    14.0.0 – 14.2.6

    12 releases, latest

6.x

  1. Affected

    6.0.0 – 6.5.8

    32 releases

5.x

  1. Affected

    5.0.0 – 5.2.4

    16 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    3 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    19 releases

2.x

  1. Affected

    2.0.0 – 2.4.4

    11 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    8 releases

0.x

  1. Affected

    0.0.1 – 0.0.5

    5 releases

155 stable releases of serve, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

What happens

Versions of serve before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems.

Recommendation

Update to version 7.0.0 or later.