GHSA-686g-3xr3-x4x6

Information Exposure on Case Insensitive File Systems in serve

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-3809

Packages

Ecosystem	Package	Affected	Fixed in
npm	serve	< 7.0.0	7.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `serve` before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems. ## Recommendation Update to version 7.0.0 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-3809 advisory
https://hackerone.com/reports/330650 web
https://github.com/advisories/GHSA-686g-3xr3-x4x6 advisory
https://www.npmjs.com/advisories/672 web