@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59149 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59149 Source advisory: SNYK:JS-MOCKOONCOMMONSSERVER-17954402...

CVE-2026-59149

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a...