Open Redirect Affecting node-static package, versions *



    Attack Complexity Low
    User Interaction Required

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-NODESTATIC-1297184
  • published 28 May 2021
  • disclosed 28 May 2021
  • credit Unknown

Introduced: 28 May 2021

CVE NOT AVAILABLE CWE-601 Open this link in a new tab

How to fix?

A fix was pushed into the master branch but not yet published.


node-static is a rfc 2616 compliant HTTP static-file server module, with built-in caching.

Affected versions of this package are vulnerable to Open Redirect. The package fails to sanitize URLs and may redirect users to domains passed through the URL. The possible redirect domains are restricted to hosts whose name matches a served folder from the application. For example if the application serves the folder ./public and has a folder ./public/, accessing localhost:8080// redirects to