serve-static

2.2.1 · 15 Dec 2025MIT202.2M / weekRepository Homepage npm Atom feed

Your version

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Line	Newest	Where it stands
	2.2.1	Safe from 2.1.0
	1.16.3	Safe from 1.16.0

Low
serve-static vulnerable to template injection that can lead to XSSGHSA-cm22-4g7w-348p · 10 Sep 2024
fixed in 2.1.0, 1.16.0
Low
Open Redirect in serve-staticGHSA-c3x7-gjmx-r2ff · 31 Aug 2020
fixed in 1.7.2

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026. Releases and advisories last read 4 Nov 2026.