CVE-2018-3712: Directory Traversal in serve
Summary
CVE-2018-3712: Directory Traversal in serve. Affects serve versions < 6.4.9. Fixed in 6.4.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Serve is an npm package that provides a simple command-line tool for serving static files. It allows users to quickly create a local server and serve their files over HTTP. Serve is widely used in web development projects to test and preview static websites or web applications. However, certain versions of serve are vulnerable to a directory traversal attack, which can allow an attacker to list the contents of directories they should not have access to.
Vulnerability Detail
The vulnerability in serve arises from its improper handling of %2e (.) and %2f (/) characters in paths. These characters are not properly sanitized, allowing an attacker to use them to traverse the directory tree and list the content of any directory accessible to the user running the serve process. While this vulnerability only allows the listing of directory contents and does not grant access to arbitrary files, it can still provide valuable information to an attacker, such as the structure of the file system and potentially sensitive file names.
How To Fix
Latest published version: 14.2.6 as of 23 Oct 2026
npm install serve@14.2.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.9
This is the first release that contains the fix.
npm install serve@6.4.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
The directory traversal vulnerability in serve can allow unauthorized directory listing, potentially exposing sensitive information to attackers. To mitigate this vulnerability, it is crucial to update serve to version 6.4.9 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for serve →
FAQ
Serve is an npm package that allows users to quickly create a local server and serve static files over HTTP. It is commonly used in web development projects for testing and previewing static websites or web applications.
Directory traversal is a technique used by attackers to access files and directories that are located outside the intended directory structure. It involves manipulating file paths to navigate to parent directories or other directories that should not be accessible.
In the case of this serve vulnerability, an attacker can use directory traversal to list the contents of directories they should not have access to. While this does not grant access to arbitrary files, it can provide valuable information to the attacker, such as the structure of the file system and potentially sensitive file names.
No, only versions of serve up to and including 6.4.8 are affected. Updating to version 6.4.9 or later will fix the vulnerability.
There is no known exploit specific to this vulnerability. However, it is always recommended to promptly update to the latest secure version of any software to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for serve.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
