serve

14.2.6 · 3 Mar 2026MIT2.3M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	14.2.6	No known advisory
	10.1.2	69 open advisories, worst high · last release Feb 2019, no longer updated

Your version

High
Cross-Site Scripting in serveGHSA-xw79-hhv6-578c · 11 Sep 2020
- 10.x10.0.0 – 10.0.1Fixed in 10.0.2
- 9.x and older0.0.1 – 9.6.0No fix, no longer updated · move to 10.0.2
High
Path Traversal in serveGHSA-48gc-5j93-5cfq · 11 Sep 2020
- 10.x10.0.0 – 10.1.1Fixed in 10.1.2
- 9.x and older0.0.1 – 9.6.0No fix, no longer updated · move to 10.1.2
High
Byass due to validation before canonicalization in serveGHSA-wm7q-rxch-43mx · 1 Sep 2020
- 6.x6.0.0 – 6.5.1Fixed in 6.5.2
- 5.x and older0.0.1 – 5.2.4No fix, no longer updated · move to 6.5.2
High
Directory Traversal in serveGHSA-xg75-3277-gvvj · 25 Mar 2019
- 7.x7.0.0 – 7.1.2Fixed in 7.1.3
- 6.x and older0.0.1 – 6.5.8No fix, no longer updated · move to 7.1.3
High
Path Traversal in serveGHSA-v588-qcp3-jv46 · 25 Mar 2019
- 6.x and older0.0.1 – 6.5.8No fix, no longer updated
Moderate
vercel/serve allows access to restricted files if filename is URL encoded.GHSA-5rc4-8qqh-vq7f · 9 Aug 2021
- 6.x6.0.0 – 6.5.1Fixed in 6.5.2
- 5.x and older0.0.1 – 5.2.4No fix, no longer updated · move to 6.5.2
Moderate
Cross-Site Scripting in serveGHSA-cpgr-wmr9-qxv4 · 11 Sep 2020
- 10.x10.0.0 – 10.0.1Fixed in 10.0.2
- 9.x and older0.0.1 – 9.6.0No fix, no longer updated · move to 10.0.2
Moderate
Directory Traversal in serveGHSA-q2qh-cgc2-qhr3 · 27 Jul 2018
- 6.x6.0.0 – 6.4.8Fixed in 6.4.9
- 5.x and older0.0.1 – 5.2.4No fix, no longer updated · move to 6.4.9
Moderate
Information Exposure on Case Insensitive File Systems in serveGHSA-686g-3xr3-x4x6 · 18 Jul 2018
- 6.x and older0.0.1 – 6.5.8No fix, no longer updated

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.