CVE-2014-6394: Directory Traversal in send
Summary
CVE-2014-6394: Directory Traversal in send. Affects send versions < 0.8.4. Fixed in 0.8.4. How to fix ↓
Also tracked for
- node-send · Debian:11
The same CVE-2014-6394 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The send package is an npm module used for serving static files over HTTP. It provides a simple API for streaming files from the file system to the client. The package is commonly used in web applications to serve static assets such as HTML, CSS, JavaScript, and images. However, versions 0.8.3 and earlier of send are vulnerable to a directory traversal attack.
Vulnerability Detail
The directory traversal vulnerability in send affects versions 0.8.3 and earlier. When the root option is used to restrict file access, an application consumer can potentially escape the restricted directory and access files in a similarly named directory. For example, if the root option is set to static(_dirname + '/public'), it would allow access to _dirname + '/public-restricted'. This vulnerability can lead to unauthorized access to sensitive files and information outside of the intended directory.
How To Fix
Latest published version: 1.2.1 as of 22 Oct 2026
npm install send@1.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.4
This is the first release that contains the fix.
npm install send@0.8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not feasible, a possible workaround is to manually implement file access restrictions and ensure that the requested files are within the intended directory. This can be done by validating and sanitizing user input, and properly configuring the file serving logic to prevent directory traversal attacks. Here's an example of a workaround code snippet:
const path = require('path');
const express = require('express');
const app = express();
app.get('/files/:filename', (req, res) => {
const requestedFile = req.params.filename;
const filePath = path.join(__dirname, 'public', requestedFile);
// Validate and sanitize the requested file path
// Implement additional security measures if needed
res.sendFile(filePath);
});
Conclusion
The directory traversal vulnerability in the send package can lead to unauthorized access to files outside of the intended directory. To mitigate this vulnerability, it is recommended to update to version 0.8.4 or later of the package. Alternatively, you can implement the provided workaround code snippet to manually restrict file access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for send →
FAQ
The directory traversal vulnerability in send allows an attacker to access files outside of the intended directory. This can lead to unauthorized access to sensitive information, such as configuration files, user data, or other confidential data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this directory traversal vulnerability in send.
Yes, a patch is available for this vulnerability. It is recommended to update to version 0.8.4 or later of the send package to fix the directory traversal vulnerability.
While there may not be specific known exploits publicly available for this vulnerability in send, directory traversal vulnerabilities are a well-known and common attack vector. It is important to promptly apply the recommended patch or workaround to mitigate the risk of exploitation.
The CWE IDs associated with this vulnerability are CWE-22, which refers to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). This CWE ID indicates that the vulnerability involves the improper handling of file paths, allowing unauthorized access to files outside of the intended directory.
References
Related vulnerabilities
Recent vulnerabilities recorded for send.
