Packages / send / Security

ModerateVulnerabilityGHSA-jgqf-hwc5-hh37CVE-2015-8859Published 24 Oct 2017

Root Path Disclosure in send

Your version

Affected releases · send

  • 0.11.x0.11.0Fixed in 0.11.1
  • 0.10.x and older0.0.1 – 0.10.1No fix, no longer updated

On 0.11.x, the newest line:

npm install send@0.11.1
Every release on a timeline
1.x

  1. Not affected

    1.0.0 – 1.2.1

    4 releases, latest

0.x

  1. Affected

    0.0.1 – 0.11.0

    35 releases

  2. Fixed

    0.11.1 – 0.19.2

    28 releases

67 stable releases of send, oldest to newest, one row per major.

What happens

Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.

Recommendation

Update to version 0.11.1 or later.