Packages / serve / Security

ModerateVulnerabilityGHSA-q2qh-cgc2-qhr3CVE-2018-3712Published 27 Jul 2018

Directory Traversal in serve

Affected releases · serve

  • 6.x6.0.0 – 6.4.8Fixed in 6.4.9
  • 5.x and older0.0.1 – 5.2.4No fix, no longer updated

On 6.x, the newest line:

npm install serve@6.4.9
14.x

  1. Not affected

    14.0.0 – 14.2.6

    12 releases, latest

6.x

  1. Affected

    6.0.0 – 6.4.8

    20 releases

  2. Fixed

    6.4.9 – 6.5.8

    12 releases

5.x

  1. Affected

    5.0.0 – 5.2.4

    16 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    3 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    19 releases

2.x

  1. Affected

    2.0.0 – 2.4.4

    11 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    8 releases

0.x

  1. Affected

    0.0.1 – 0.0.5

    5 releases

155 stable releases of serve, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

What happens

Affected versions of serve do not properly handle %2e (.) and %2f (/) characters, and allow the, characters to be used in paths. This can be used to traverse the directory tree and list content of any directory the user running the process has access to.

Mitigating factors: This vulnerability only allows listing of directory contents and does not allow reading of arbitrary files.

Recommendation

Update to version 6.4.9 later.