---
title: "serve-static security advisories"
description: "2 known security advisories for serve-static, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/serve-static/security
lang: en
---

[Packages](https://inlinr.com/packages)

# serve-static

2.2.1 · 15 Dec 2025 MIT 202.2M / week [Repository](https://github.com/expressjs/serve-static) [Homepage](https://github.com/expressjs/serve-static#readme) [npm](https://www.npmjs.com/package/serve-static) [Atom feed](https://inlinr.com/packages/feed/serve-static)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands  |
| ---- | ------ | ---------------- |
|      | 2.2.1  | Safe from 2.1.0  |
|      | 1.16.3 | Safe from 1.16.0 |

- Low  
[serve-static vulnerable to template injection that can lead to XSS](https://inlinr.com/advisories/GHSA-cm22-4g7w-348p)GHSA-cm22-4g7w-348p · 10 Sep 2024  
fixed in 2.1.0, 1.16.0
- Low  
[Open Redirect in serve-static](https://inlinr.com/advisories/GHSA-c3x7-gjmx-r2ff)GHSA-c3x7-gjmx-r2ff · 31 Aug 2020  
fixed in 1.7.2

### Quality and security signals

What [npm](https://www.npmjs.com/package/serve-static) and [deps.dev](https://deps.dev/npm/serve-static) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.