Packages / serve / Security

HighVulnerabilityGHSA-xg75-3277-gvvjCVE-2019-5417Published 25 Mar 2019

Directory Traversal in serve

Affected releases · serve

  • 7.x7.0.0 – 7.1.2Fixed in 7.1.3
  • 6.x and older0.0.1 – 6.5.8No fix, no longer updated

On 7.x, the newest line:

npm install serve@7.1.3
14.x

  1. Not affected

    14.0.0 – 14.2.6

    12 releases, latest

7.x

  1. Affected

    7.0.0 – 7.1.2

    5 releases

  2. Fixed

    7.1.3 – 7.2.0

    5 releases

6.x

  1. Affected

    6.0.0 – 6.5.8

    32 releases

5.x

  1. Affected

    5.0.0 – 5.2.4

    16 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    3 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    19 releases

2.x

  1. Affected

    2.0.0 – 2.4.4

    11 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    8 releases

0.x

  1. Affected

    0.0.1 – 0.0.5

    5 releases

155 stable releases of serve, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

What happens

Versions of serve before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files.

Recommendation

Upgrade to version 7.1.3 or later