GHSA-5g97-whc9-8g7j

node-static and @nubosoftware/node-static vulnerable to Directory Traversal

Source: GitHub Advisory Database (reviewed) High CVE-2023-26111

Packages

Ecosystem	Package	Affected	Fixed in
npm	node-static	<= 0.7.11	no fix listed
npm	@nubosoftware/node-static	<= 0.7.11	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

node-static and its fork, @nubosoftware/node-static, are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-26111 advisory
https://gist.github.com/lirantal/c80b28e7bee148dc287339cb483e42bc web
https://github.com/cloudhead/node-static package
https://github.com/cloudhead/node-static/blob/master/lib/node-static.js#23L160-L163 web
https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-3149928 web
https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927 web