serve-static
2.2.1 · 15 Dec 2025MIT202.2M / weekRepositoryHomepagenpmAtom feed
Your version
1.16.3 is the newest release of 1.x.
In short
1 changed
Security
1 advisory affects 1.12.0; 1.16.0 fixes them
- Lowserve-static vulnerable to template injection that can lead to XSSGHSA-cm22-4g7w-348p · 10 Sep 2024Fixed in 1.16.0
Release note
Send complete HTML document in redirect response
Set default CSP header in redirect response
deps: send@0.15.0
Fix false detection of
no-cacherequest directiveFix incorrect result when
If-None-Matchhas both*and ETagsFix weak
ETagmatching to match specRemove usage of
res._headersprivate fieldSupport
If-MatchandIf-Unmodified-SinceheadersUse
res.getHeaderNames()when availableUse
res.headersSentwhen availabledeps: debug@2.6.1
deps: etag@~1.8.0
deps: fresh@0.5.0
deps: http-errors@~1.6.1