Most recent entries from all

EUVD-2026-90040

fkie_cve-2015-1164

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.

GHSA-c3x7-gjmx-r2ff — Open Redirect in serve-static

Affected: npm: serve-static

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.

## Proof of Concept

A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`

Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.

## Recommendation

Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.

gsd-2015-1164

Withdrawn: UBUNTU-CVE-2015-1164

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: node-serve-static, Ubuntu:18.04:LTS: node-serve-static