Packages / serve / Security

HighVulnerabilityGHSA-v588-qcp3-jv46CVE-2019-5415Published 25 Mar 2019

Path Traversal in serve

Affected releases · serve

  • 6.x and older0.0.1 – 6.5.8No fix, no longer updated

6.x has no fix yet; the newest fixed line:

npm install serve@7.0.0
14.x

  1. Not affected

    14.0.0 – 14.2.6

    12 releases, latest

6.x

  1. Affected

    6.0.0 – 6.5.8

    32 releases

5.x

  1. Affected

    5.0.0 – 5.2.4

    16 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    3 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    19 releases

2.x

  1. Affected

    2.0.0 – 2.4.4

    11 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    8 releases

0.x

  1. Affected

    0.0.1 – 0.0.5

    5 releases

155 stable releases of serve, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

What happens

Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files.

Recommendation

Upgrade to version 7.0.1 or later.