Serve-static, a vital npm package for serving static files, saw a notable update from version 1.14.1 to 1.14.2. While the core functionality remains the same for developers using the library to serve static content, several underlying changes improve the developer experience and security. The most significant update resides in the send dependency, which jumps from version 0.17.1 to 0.17.2, likely incorporating bug fixes and potential security improvements a better and more robust file delivery.
The development environment received a significant overhaul. Version 1.14.2 embraces modern tooling, featuring newer versions of essential packages like nyc (code coverage), mocha (testing), and eslint (code linting), with the greatest update in eslint, changing from 5.16.0 to 7.32.0. This also includes updates to several ESLint plugins that can improve code maintainability and consistency: eslint-plugin-node, eslint-plugin-import, eslint-plugin-promise, eslint-config-standard, eslint-plugin-markdown, eslint-plugin-standard. Developers benefiting from an updated development environment can find improvements, new features and security upgrades that will facilitate code maintenance and prevent future vulnerabilities. While the file count remains at 5, the unpacked size increased slightly from 24894 to 24950, potentially indicating underlying code adjustments or dependency updates beyond the visible version bumps. Overall, upgrading to version 1.14.2 offers a more secure and developer-friendly static file serving experience.
All the vulnerabilities related to the version 1.14.2 of the package
serve-static vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code
this issue is patched in serve-static 1.16.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
send vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code
this issue is patched in send 0.19.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following:
