---
title: "GHSA-c3x7-gjmx-r2ff: Open Redirect in serve-static"
description: "Low severity. Open Redirect in serve-static. Affects serve-static; fixed in 1.7.2."
url: https://inlinr.com/advisories/GHSA-c3x7-gjmx-r2ff
lang: en
---

[Packages](https://inlinr.com/packages) / [serve-static](https://inlinr.com/packages/serve-static) / [Security](https://inlinr.com/packages/serve-static/security)

Low Vulnerability GHSA-c3x7-gjmx-r2ff CVE-2015-1164 Published 31 Aug 2020

# Open Redirect in serve-static

Your version 

Affected releases · [serve-static](https://inlinr.com/packages/serve-static)

- 1.x 1.0.0 – 1.7.1 Fixed in 1.7.2

On 1.x, the newest line:

```
npm install serve-static@1.7.2
```

Every release on a timeline

2.x 

1. Not affected

2.0.0 – 2.2.1  
4 releases, latest

1.x 

1. Affected

1.0.0 – 1.7.1  
31 releases
2. Fixed

1.7.2 – 1.16.3  
32 releases

67 stable releases of serve-static, oldest to newest, one row per major.

## What happens

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.

Proof of Concept

A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`

Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.

Recommendation

Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.

## How it is exploited

Exploitable over the network, with no account and a user to do something.

- **Confidentiality**: none
- **Integrity**: low
- **Availability**: none

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:R/​S:U/​C:N/​I:L/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-1164 "https://nvd.nist.gov/vuln/detail/CVE-2015-1164")  
nvd.nist.gov/vuln/detail/CVE-2015-1164
- [Issue](https://github.com/expressjs/serve-static/issues/26 "https://github.com/expressjs/serve-static/issues/26")  
#26
- [Reference](https://bugzilla.redhat.com/show%5Fbug.cgi?id=1181917 "https://bugzilla.redhat.com/show_bug.cgi?id=1181917")  
bugzilla.redhat.com/show\_bug.cgi
- [Reference](https://exchange.xforce.ibmcloud.com/vulnerabilities/99936 "https://exchange.xforce.ibmcloud.com/vulnerabilities/99936")  
exchange.xforce.ibmcloud.com/vulnerabilities/99…
- [Package](https://github.com/expressjs/serve-static "https://github.com/expressjs/serve-static")  
github.com/expressjs/serve-static
- [Reference](https://snyk.io/vuln/npm:serve-static:20150113 "https://snyk.io/vuln/npm:serve-static:20150113")  
snyk.io/vuln/npm:serve-static:20150113
- [Reference](https://www.npmjs.com/advisories/35 "https://www.npmjs.com/advisories/35")  
npmjs.com/advisories/35
- [Reference](http://www.securityfocus.com/bid/72064 "http://www.securityfocus.com/bid/72064")  
securityfocus.com/bid/72064