Send is a Node.js package serving as a streamlined static file server with advanced features like Range and conditional-GET support, crucial for efficiently delivering content to web browsers. Comparing versions 0.17.0 and 0.17.1, developers will notice a subtle but important distinction. While both versions share the same core functionality and most dependencies, the key difference lies within the range-parser dependency. Version 0.17.1 has range-parser at version 1.2.1, while 0.17.0 uses version 1.2.0. This seemingly minor patch version update in range-parser likely addresses bug fixes or performance improvements related to HTTP range requests.
Beyond this dependency update, developers can rely on Send for features like efficient streaming of static files, handling of range requests (allowing clients to request specific parts of a file), and conditional-GET support (reducing bandwidth usage by only sending files that have changed). Other dependencies like mime, etag, and fresh are instrumental in determining the correct MIME type, generating ETags for caching, and handling HTTP cache validation, respectively. Developers building web applications where serving static assets efficiently is critical will find Send a valuable tool, offering optimization without requiring extensive manual configuration. Also, the releaseDate of version 0.17.1 is "2019-05-11T01:40:56.003Z" and the releaseDate of version 0.17.0 is "2019-05-03T21:34:26.929Z" which indicates that the newer version was released approximately one week after the older version.
All the vulnerabilities related to the version 0.17.1 of the package
send vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code
this issue is patched in send 0.19.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
