serve-static

2.2.1 · 15 Dec 2025MIT202.2M / weekRepository Homepage npm Atom feed

Your version

1.5.1

10 Aug 2014Where it was published

1.16.3 is the newest release of 1.x.

In short

1 fixed2 internal

Security

2 advisories affect 1.5.1; 1.16.0 fixes them

Low
serve-static vulnerable to template injection that can lead to XSSGHSA-cm22-4g7w-348p · 10 Sep 2024
Fixed in 1.16.0
Low
Open Redirect in serve-staticGHSA-c3x7-gjmx-r2ff · 31 Aug 2020
Fixed in 1.7.2

Release note

Fix parsing of weird req.originalUrl values