Denial of Service in node-static

published 2021-09-22 5y ago modified 2025-10-03 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.

Patch / fix

links 1

github.com/cloudhead/node-static#213 pull request

Is GHSA-8r4g-cg4m-x23c in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	node-static	<=0.7.11	no fix listed

Classification

Weakness

CWE-248 Uncaught Exception
CWE-400 Uncontrolled Resource Consumption

References

Sources

GitHub Advisory GHSA-8r4g-cg4m-x23c

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.