CVE-2015-1164

CVE-2015-1164 describes an open redirect in the Node.js module serve-static . Versions prior to 1.7.2 (and 1.6.x before 1.6.5) are affected when mounted at the root, enabling attackers to redirect victims to arbitrary sites by using a // in the PATH_INFO (e.g., //google.com/…). The issue can faci...