GitHub Advisoryadvisory · npm

GHSA-8r4g-cg4m-x23c Denial of Service in node-static

MEDIUM Published 2021-09-22 Modified 2025-10-03 Official page ↗
Ecosystem
npm
Packages
node-static
Severity
Moderate
Weaknesses
CWE-248, CWE-400
Reviewed
2021-09-22

Affected packages

• npm node-static: <= 0.7.11 (no fix yet)

Description

All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.

Related

Weakness · CWE (2)

  • CWE-248 Uncaught Exception weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References