---
title: "send security advisories"
description: "3 known security advisories for send, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/send/security
lang: en
---

[Packages](https://inlinr.com/packages)

# send

1.2.1 · 15 Dec 2025 MIT 207M / week [Repository](https://github.com/pillarjs/send) [Homepage](https://github.com/pillarjs/send#readme) [npm](https://www.npmjs.com/package/send) [Atom feed](https://inlinr.com/packages/feed/send)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                                |
| ---- | ------ | ------------------------------------------------------------------------------ |
|      | 1.2.1  | No known advisory                                                              |
|      | 0.19.2 | No known advisory                                                              |
|      | 0.18.0 | 38 open advisories, worst moderate  · last release Mar 2022, no longer updated |

- Moderate  
[Root Path Disclosure in send](https://inlinr.com/advisories/GHSA-jgqf-hwc5-hh37)GHSA-jgqf-hwc5-hh37 · 24 Oct 2017  
fixed in 0.11.1
- Low  
[send vulnerable to template injection that can lead to XSS](https://inlinr.com/advisories/GHSA-m6fv-jmcg-4jfg)GHSA-m6fv-jmcg-4jfg · 10 Sep 2024
- Low  
[Directory Traversal in send](https://inlinr.com/advisories/GHSA-xwg4-93c6-3h42)GHSA-xwg4-93c6-3h42 · 24 Oct 2017  
fixed in 0.8.4

### Quality and security signals

What [npm](https://www.npmjs.com/package/send) and [deps.dev](https://deps.dev/npm/send) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.