Description
serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | serve node module | Versions before 6.4.9 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | serve | < 6.4.9 | 6.4.9 | GHSA-q2qh-cgc2-qhr3 |