serve-static (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package serve-static, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2024-43800 — CVSS 5.0 (medium): serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted…
• CVE-2015-1164 — CVSS 4.3 (medium): Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to…