Packages / serve-static / Security

LowVulnerabilityGHSA-c3x7-gjmx-r2ffCVE-2015-1164Published 31 Aug 2020

Open Redirect in serve-static

Your version

Affected releases · serve-static

  • 1.x1.0.0 – 1.7.1Fixed in 1.7.2

On 1.x, the newest line:

npm install serve-static@1.7.2
Every release on a timeline
2.x

  1. Not affected

    2.0.0 – 2.2.1

    4 releases, latest

1.x

  1. Affected

    1.0.0 – 1.7.1

    31 releases

  2. Fixed

    1.7.2 – 1.16.3

    32 releases

67 stable releases of serve-static, oldest to newest, one row per major.

What happens

Versions of serve-static prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.

Proof of Concept

A link to http://example.com//www.google.com/%2e%2e will redirect to //www.google.com/%2e%2e

Some browsers will interpret this as http://www.google.com/%2e%2e, resulting in an external redirect.

Recommendation

Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.