Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-JS-NODESTATIC-1297184
- published 28 May 2021
- disclosed 28 May 2021
- credit Unknown
Introduced: 28 May 2021CVE NOT AVAILABLE CWE-601 Open this link in a new tab
How to fix?
A fix was pushed into the
master branch but not yet published.
node-static is a rfc 2616 compliant HTTP static-file server module, with built-in caching.
Affected versions of this package are vulnerable to Open Redirect. The package fails to sanitize URLs and may redirect users to domains passed through the URL. The possible redirect domains are restricted to hosts whose name matches a served folder from the application. For example if the application serves the folder
./public and has a folder ./public/example.com, accessing
localhost:8080//example.com redirects to