GHSA-WM7Q-RXCH-43MX Byass due to validation before canonicalization in serve

Versions of serve before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames. Example: Here we have a server that ignores the file test.txt. const serve = require'serve' const server =...

PT-2020-21562

Name of the Vulnerable Software and Affected Versions serve versions prior to 6.5.2 Description The issue allows for the bypass of the ignore functionality due to validation occurring before canonicalization of paths and filenames. This can be exploited by using URL encoded characters in file...