CVE-2017-16224: Open Redirect in st
Summary
CVE-2017-16224: Open Redirect in st. Affects st versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'st' module is used for serving static files in Node.js applications. It allows developers to easily serve static files such as HTML, CSS, and JavaScript. However, versions of 'st' prior to 1.2.2 are vulnerable to an open redirect attack.
Vulnerability Detail
An attacker can exploit this vulnerability by crafting a request that triggers an HTTP 301 redirect to a different domain. This can be achieved by sending a request to the server's root ('/') with a URL-encoded '..' (%2e%2e) appended at the end. Browsers treat the redirect as valid, as the '%2e%2e' is translated into the current schema being used. The impact of this vulnerability is that an attacker can trick users into visiting malicious websites or phishing pages.
How To Fix
Latest published version: 4.0.12 as of 22 Oct 2026
npm install st@4.0.12Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.2
This is the first release that contains the fix.
npm install st@1.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the 'st' module is not immediately possible, a temporary workaround is to ensure that 'st' is serving from a subdirectory ('/static/') instead of the root ('/'). This will mitigate the vulnerability as the redirect URL will not end with URL-encoded '..'.
Conclusion
The 'st' module prior to version 1.2.2 is vulnerable to an open redirect attack. It is crucial to update to the latest version to mitigate this vulnerability. If immediate updating is not possible, serving 'st' from a subdirectory can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for st →
FAQ
An open redirect vulnerability allows an attacker to redirect users to a different website or page, potentially leading to phishing attacks or the execution of malicious code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for known vulnerabilities.
Yes, an attacker can exploit this vulnerability by crafting a specific request that triggers the open redirect behavior in the 'st' module.
In order for this vulnerability to be exploitable, the 'st' module must be serving from the root ('/') of the server instead of a subdirectory ('/static/'). Additionally, the redirect URL must end with URL-encoded '..' (%2e%2e).
In addition to updating the 'st' module, it is recommended to regularly update all dependencies in your Node.js application to ensure you have the latest security patches.
Related vulnerabilities
Recent vulnerabilities recorded for st.
