---
title: "serve-static 2.2.1"
description: "Latest published version of serve-static is 2.2.1, licensed MIT. Current as of our last registry check."
url: https://inlinr.com/packages/serve-static
lang: en
---

[Packages](https://inlinr.com/packages)

# serve-static

2.2.1 · 15 Dec 2025 MIT 202.2M / week [Repository](https://github.com/expressjs/serve-static) [Homepage](https://github.com/expressjs/serve-static#readme) [npm](https://www.npmjs.com/package/serve-static) [Atom feed](https://inlinr.com/packages/feed/serve-static)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/serve-static/upgrade)

LineNewestSecurity

- 2.x 2.2.1 Safe from 2.1.0 Latest line
- 1.x 1.16.3 Safe from 1.16.0 [To 2.2.1](https://inlinr.com/packages/serve-static/upgrade/1.16.3-2.2.1)

## Latest releases

[All 67 releases](https://inlinr.com/packages/serve-static/releases)

1. 2.x · latest line
2. ### [2.2.1](https://inlinr.com/packages/serve-static/releases/2.2.1 "Open this release") [](https://github.com/expressjs/serve-static/releases/tag/v2.2.1 "Read this release where it was published")  
15 Dec 2025

  - Remove `HISTORY.md` from tarball content
3. ### [2.2.0](https://inlinr.com/packages/serve-static/releases/2.2.0 "Open this release") [](https://github.com/expressjs/serve-static/releases/tag/v2.2.0 "Read this release where it was published")  
28 Mar 2025

  - Refactor HISTORY.md header update to use String.prototype.repeat
  - Conditionally set headers (if not already set) in redirect response
  - Revert "feat: conditionally set headers (if not already set) in redirect response ([#190](https://github.com/expressjs/serve-static/issues/190))"
4. ### [2.1.0](https://inlinr.com/packages/serve-static/releases/2.1.0 "Open this release") [](https://github.com/expressjs/serve-static/releases/tag/2.1.0 "Read this release where it was published")  
10 Sep 2024

  - Remove link renderization in html while redirecting ([#173](https://github.com/expressjs/serve-static/pull/173 "https://github.com/expressjs/serve-static/pull/173"))
  - Update dev deps
  - Update prod deps for v2

Dependency tracking · free for 3 projects

## Know when your own dependencies move

This page watches serve-static. inlinr reads your package.json and keeps the same watch on every dependency you declare, then tells you only what needs you.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

[Details](https://inlinr.com/packages/serve-static/security)

- [serve-static vulnerable to template injection that can lead to XSS](https://inlinr.com/advisories/GHSA-cm22-4g7w-348p) Low · fixed in 2.1.0, 1.16.0
- [Open Redirect in serve-static](https://inlinr.com/advisories/GHSA-c3x7-gjmx-r2ff) Low · fixed in 1.7.2

## Health

[Details](https://inlinr.com/packages/serve-static/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.