Astra Linux – Vulnerability in HAPProxy

Before version 2.8.2, HAProxy allowed to be part of the URI component. This could allow remote attackers to obtain sensitive information or cause unspecified other issues due to misinterpretation of the pathend rule, such as routing index.html.png to a static server...

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Impact @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file o...

@cognidesk/integration-ticketing-servicenow (>=0.0.4, <=0.0.6), @darthcav/ts-http-server (0.9.1) +16 more potentially affected by CVE-2026-7120 via @fastify/static (>=10.1.0, <=10.1.1)

@fastify/static NPM version =10.1.0, =0.0.4, =0.7.1, =3.1.17, =1.3.8, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =5.1.0, =6.5.2, =4.6.0, =4.8.4 and more Source cves: CVE-2026-7120 Source advisory: OSV:GHSA-8PVW-JCV7-9CMJ...

@darthcav/ts-http-server (0.9.1), @digitalpaws/starr (0.0.2) +5 more potentially affected by CVE-2026-15074 via @fastify/static (10.1.0)

@fastify/static NPM version 10.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/static and may be impacted: - @darthcav/ts-http-server 0.9.1 - @digitalpaws/starr 0.0.2 - @node-cli/static-server =3.1.17, =9.0.0-canary.19, =9.0.2 -...

NPM: better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

NPM: better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server vulnerability discovered by ? in WordPress Npm better-helperjs versions = 3.0.5...

GHSA-3P34-W4F6-5XH2 better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

Summary A directory traversal vulnerability exists in the production static file server of better-helperjs = 3.0.5. Attackers can read arbitrary files located in adjacent directory structures that share the same string prefix as the intended static root directory. Details The framework utilizes a...

better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

Summary A directory traversal vulnerability exists in the production static file server of better-helperjs = 3.0.5. Attackers can read arbitrary files located in adjacent directory structures that share the same string prefix as the intended static root directory. Details The framework utilizes a...

WS-2019-0227

file-static-server all versions are vulnerable to path traversal because of insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files...

MAL-2026-3491 Malicious code in @tanstack/start-static-server-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb21ff47aa0e512d1f67b02a37d160b475e32fcaa76bea381298a976c3bdd673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @tanstack/start-static-server-functions

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @tanstack/start-static-server-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb21ff47aa0e512d1f67b02a37d160b475e32fcaa76bea381298a976c3bdd673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2022-7760

Malicious code in bioql PyPI...

EUVD-2023-2815

Malicious code in bioql PyPI...

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

...

CVE-2023-26152

All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js...

Malware in console-webapp-static-server

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in console-webapp-static-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 881f4b0e9d871a25620edd0bdf015644703eb56726d7b1785e5e0eb18ca32e36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...

Path Traversal

@hono/node-server is vulnerable to Path Traversal. The vulnerability is due to improper url string validation in src/request.ts, allowing an attacker to use .. in the request URL to access arbitrary files on the static server...