---
title: "connect security advisories"
description: "3 known security advisories for connect, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/connect/security
lang: en
---

[Packages](https://inlinr.com/packages)

# connect

3.7.0 · 18 May 2019 MIT 30.2M / week [Repository](https://github.com/senchalabs/connect) [Homepage](https://github.com/senchalabs/connect#readme) [npm](https://www.npmjs.com/package/connect) [Atom feed](https://inlinr.com/packages/feed/connect)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                                |
| ---- | ------ | ------------------------------------------------------------------------------ |
|      | 3.7.0  | No known advisory                                                              |
|      | 2.30.2 | 21 open advisories, worst moderate  · last release Jul 2015, no longer updated |

- Moderate  
[Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware](https://inlinr.com/advisories/GHSA-6w62-83g6-rfhj)GHSA-6w62-83g6-rfhj · 5 May 2022  
fixed in 2.8.2
- Moderate  
[Cross-Site Scripting in connect](https://inlinr.com/advisories/GHSA-rch9-xh7r-mqgw)GHSA-rch9-xh7r-mqgw · 26 Jul 2018  
fixed in 2.14.0
- Low  
[methodOverride Middleware Reflected Cross-Site Scripting in connect](https://inlinr.com/advisories/GHSA-3fw8-66wf-pr7m)GHSA-3fw8-66wf-pr7m · 31 Aug 2020  
fixed in 2.8.1

### Quality and security signals

What [npm](https://www.npmjs.com/package/connect) and [deps.dev](https://deps.dev/npm/connect) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.