Send is a Node.js library designed for efficient static file serving, equipped with features like Range and conditional-GET support for optimized delivery. Examining versions 0.15.6 and 0.15.5 reveals subtle yet potentially impactful changes for developers. Both versions share the same core dependencies, including modules for handling HTTP errors, URL encoding, HTML escaping, and managing request ranges. They also offer the same suite of development dependencies, ensuring consistent testing and linting environments, utilizing tools like Mocha, ESLint, and Supertest for quality assurance.
However, a notable distinction lies within the 'debug' dependency. Version 0.15.6 upgrades to debug 2.6.9, while version 0.15.5 relies on debug 2.6.8. While seeming minor, this update in 'debug' could introduce bug fixes, performance improvements, or enhanced debugging capabilities that may affect the observable behavior of 'send' during development and troubleshooting. Developers relying heavily on debug output for diagnosing issues should carefully consider this difference.
Additionally, the release dates highlight active maintenance. Version 0.15.6 was released on September 22, 2017, a day after version 0.15.5, suggesting a possible quick fix or minor update prompted by the previous release. This indicates ongoing attention and responsiveness from the maintainers, providing confidence in the library's continued support. The core functionality remains consistent, promising reliable static file serving across both versions.
All the vulnerabilities related to the version 0.15.6 of the package
send vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code
this issue is patched in send 0.19.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Update to version 2.0.3 or later.
