Improper Input Validation

@nubosoftware/node-static is vulnerable to improper input validation.The vulnerability is due to the package failing to handle null-byte %00 input correctly, which allows an attacker to trigger an exception and crash the server...

node-static 安全漏洞

node-static is an rfc 2616-compliant HTTP static file server module with built-in caching by Alexis Sellier, an individual developer. A security vulnerability exists in node-static that stems from an uncaught user input exception containing a null byte, which could cause the server to crash...

GHSA-5G97-WHC9-8G7J node-static and @nubosoftware/node-static vulnerable to Directory Traversal

node-static and its fork, @nubosoftware/node-static, are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith method in the servePath function...

277snippet-cli (>=1.0.0 <=1.0.2), 40au-isteven-angular-multiselect (=4.0.0) +740 more potentially affected by CVE-2023-26111 via node-static (>=0.5.6 <=0.7.9)

node-static NPM version =0.5.6, =1.0.0, =1.0.5, =0.0.5, =0.0.1, =0.0.1, =17.0.6 and more Source cves: CVE-2023-26111 Source advisory: SNYK:JS-NODESTATIC-3149928...

40au-isteven-angular-multiselect (=4.0.0), @abcd19/st-grid (=3.1.0) +724 more potentially affected by CVE-2025-11149 via node-static (>=0.5.6 <=0.7.11)

node-static NPM version =0.5.6, =1.0.5, =0.0.5, =0.0.1, =0.0.1, =17.0.6 - @beadswap/lib =0.0.1 and more Source cves: CVE-2025-11149 Source advisory: OSV:GHSA-8R4G-CG4M-X23C...

277snippet-cli (>=1.0.0 <=1.0.2), 40au-isteven-angular-multiselect (=4.0.0) +740 more potentially affected by CVE-2025-11149 via node-static (>=0.5.6 <=0.7.9)

node-static NPM version =0.5.6, =1.0.0, =1.0.5, =0.0.5, =0.0.1, =0.0.1, =17.0.6 and more Source cves: CVE-2025-11149 Source advisory: SNYK:JS-NODESTATIC-1297183...

Denial Of Service (DoS)

node-static is vulnerable to denial of service DoS. The attack exists because it does not properly handle the argument 'path', allowing the attacker to input the path \u0000 NULL to crash fs.stat with the error message "TypeError ERRINVALIDARGVALUE: The argument 'path' must be a string or...