Serve-static versions 1.13.0 and 1.12.6, both creations of Douglas Christopher Wilson and licensed under MIT, provide a robust solution for serving static files in Node.js applications, especially within the Express.js ecosystem. A key focus for developers considering an upgrade revolves around the updated dependencies. Version 1.13.0 features a notable upgrade in its "send" dependency, moving to version 0.16.0, versus the older version 0.15.6 found in 1.12.6. This "send" upgrade likely brings performance enhancements, bug fixes, and potentially new features for handling file delivery, making version 1.13.0 more efficient and reliable for serving files.
Both versions share the same core dependencies, including "parseurl," "encodeurl," and "escape-html," and identical developer dependencies like "mocha," "eslint," and related linting plugins, which indicates consistent testing and code quality practices. The release date difference also points to improvements and refinements made between the releases. Version 1.13.0 was released on September 28, 2017, a few days later than the older 1.12.6 version released on September 23, 2017. While the core functionality remains consistent, developers should prioritize version 1.13.0 for its potentially enhanced file serving capabilities via the updated "send" dependency, leading to a better experience serving static website assets and files.
All the vulnerabilities related to the version 1.13.0 of the package
serve-static vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code
this issue is patched in serve-static 1.16.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
send vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code
this issue is patched in send 0.19.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
