https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T01:18:38.472052+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-90040 EUVD-2026-90040 2026-10-17T01:18:38.557052+00:00 EUVD-2026-90040 https://cve.radiocsirt.org/vuln/fkie_cve-2015-1164 fkie_cve-2015-1164 2026-10-17T01:18:38.557094+00:00

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.

 https://cve.radiocsirt.org/vuln/ghsa-c3x7-gjmx-r2ff GHSA-c3x7-gjmx-r2ff — Open Redirect in serve-static 2026-10-17T01:18:38.557128+00:00

Affected: npm: serve-static

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.

## Proof of Concept

A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`

Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.

## Recommendation

Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.

 https://cve.radiocsirt.org/vuln/gsd-2015-1164 gsd-2015-1164 2026-10-17T01:18:38.557158+00:00 gsd-2015-1164 https://cve.radiocsirt.org/vuln/ubuntu-cve-2015-1164 Withdrawn: UBUNTU-CVE-2015-1164 2026-10-17T01:18:38.557170+00:00

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: node-serve-static, Ubuntu:18.04:LTS: node-serve-static

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.