PT-2025-39959

Name of the Vulnerable Software and Affected Versions node-static affected versions not specified @nubosoftware/node-static affected versions not specified Description The software does not properly handle user input containing null bytes. This can allow attackers to access http://host/%00 and...

PT-2021-24404

Name of the Vulnerable Software and Affected Versions: node-static versions all Description: The issue allows attackers to crash the server by accessing a specific URL, http://host/%00, due to the package's failure to catch an exception when user input includes null bytes. Recommendations: For al...

277snippet-cli (>=1.0.0, <=1.0.2), 40au-isteven-angular-multiselect (4.0.0) +741 more potentially affected by CVE-2025-11149 via node-static (>=0.5.6, <=0.7.11)

node-static NPM version =0.5.6, =1.0.0, =1.0.5, =0.0.5, =0.0.1, =0.0.1, =17.0.6 and more Source cves: CVE-2025-11149 Source advisory: SNYK:JS-NODESTATIC-1297183...

Denial of Service (DoS)

Overview @nubosoftware/node-static is a simple, compliant file streaming module for node Affected versions of this package are vulnerable to Denial of Service DoS. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and cras...

Denial of Service (DoS)

Overview node-static is a rfc 2616 compliant HTTP static-file server module, with built-in caching. Affected versions of this package are vulnerable to Denial of Service DoS. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%...

Directory Traversal

node-static is vulnerable to directory traversal. When the static HTTP server is run with indexFile option and can somehow be controlled by a malicious local user, the directory traversal ../ characters can be injected to access confidential files outside of the web directory. This can also...

Denial of Service

Overview All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server. Recommendation No fix is currently available. Consider using an alternativ...

Open Redirect

Overview All versions of node-static are vulnerable to Open Redirect. The package fails to sanitize URLs and may redirect users to domains passed through the URL. The possible redirect domains are restricted to hosts whose name matches a served folder from the application. For example if the...

Unauthorized File Access

Overview All versions of node-static are vulnerable to Unauthorized File Access. The package fails to prevent access to files outside of the served folder if the filename begins with the name of the served folder. For example if an application is serving the folder ./public, a file such as...

Node.js third-party modules: `indexFile` option passed as an argument to node-server can lead to arbitrary file read

Hi Guys, I would like to report Path Traversal vulnerability in indexFile parameter passed as an option tonode-server. This vulnerability affects both CLI --indexFile and options.indexFile passed as an argument to Server.prototype.serveDir function in node-static.js Module module name: node-stati...

Denial Of Service (DoS)

node-static is vulnerable to denial of service DoS. The attack exists because it does not properly handle the argument 'path', allowing the attacker to input the path \u0000 NULL to crash fs.stat with the error message "TypeError ERRINVALIDARGVALUE: The argument 'path' must be a string or...