Packages / connect / Security

ModerateVulnerabilityGHSA-rch9-xh7r-mqgwCVE-2018-3717Published 26 Jul 2018

Cross-Site Scripting in connect

Your version

Affected releases · connect

  • 2.x2.0.0 – 2.13.1Fixed in 2.14.0
  • 1.x and older0.0.1 – 1.9.2No fix, no longer updated

On 2.x, the newest line:

npm install connect@2.14.0
Every release on a timeline
3.x

  1. Not affected

    3.0.0 – 3.7.0

    25 releases, latest

2.x

  1. Affected

    2.0.0 – 2.13.1

    64 releases

  2. Fixed

    2.14.0 – 2.30.2

    68 releases

1.x

  1. Affected

    1.0.0 – 1.9.2

    48 releases

0.x

  1. Affected

    0.0.1 – 0.5.10

    28 releases

233 stable releases of connect, oldest to newest, one row per major.

What happens

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.