send (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package send, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2014-6394 — CVSS 7.5 (high): visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which…
• CVE-2015-8859 — CVSS 5.3 (medium): The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
• CVE-2024-43799 — CVSS 5.0 (medium): Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect()…