Node-static vulnerabilities
We track 2 vulnerabilities in Node-static products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2025.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Node-static vulnerabilities
- 7.5 High severity
node-static: Uncontrolled Resource Consumption
This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.
- 7.5 High severity
@nubosoftware/node-static: Improper Limitation of a Pathname to a Restricted Directory
All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.