npm node-static vulnerabilities

Latest npm node-static CVEs

Newest publication first

1. CVE-2023-26111 node-static and @nubosoftware/node-static vulnerable to Directory Traversal

   Published 2023-03-06

   High·CVSS 7.5

   All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.

2. GHSA-8r4g-cg4m-x23c Denial of Service in node-static

   Published 2021-09-22

   Unknown

   All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.