Serve-static is a popular npm package designed to effortlessly serve static files in Node.js applications, commonly used with frameworks like Express.js. Comparing versions 1.14.1 and 1.14.0 reveals subtle but potentially impactful differences for developers. Both versions rely on the same core set of dependencies for file serving, including parseurl, encodeurl, and escape-html. The primary difference lies in the send dependency; 1.14.1 utilizes version 0.17.1, while 1.14.0 uses 0.17.0. This send package update is crucial as it manages the actual file transmission and could contain bug fixes, performance improvements, or security patches.
Developers already using serve-static should upgrade to 1.14.1 to potentially benefit from any enhancements or fixes within the newer send dependency. The updated version was released on May 11, 2019, a few days after 1.14.0. Those setting up serve-static for the first time should opt for the newer version to ensure they're starting with the most up-to-date and potentially stable foundation. To benefit from the library, npm install serve-static in your project and use it as a middleware in your Express app. These improvements are released by the author Douglas Christopher Wilson, who has committed a valid amount of useful changes to the open source community.
All the vulnerabilities related to the version 1.14.1 of the package
serve-static vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code
this issue is patched in serve-static 1.16.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
send vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code
this issue is patched in send 0.19.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
