Path Traversal Vulnerability in angular-http-server
Summary
GHSA-vmhw-fhj6-m3g5: Path Traversal in angular-http-server. Affects angular-http-server versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
angular-http-server is an npm package that provides a simple HTTP server for Angular applications. It allows developers to serve their Angular projects locally during development. The package is widely used in the Angular community for its convenience and ease of use. However, versions prior to 1.4.4 are vulnerable to a path traversal vulnerability.
Vulnerability Detail
The path traversal vulnerability in angular-http-server allows an attacker to access files outside of the intended directory. By manipulating the file path in a specific way, an attacker can bypass the server's intended restrictions and retrieve sensitive files from the host system. This can lead to unauthorized access to sensitive information or even remote code execution.
How To Fix
Latest published version: 1.12.0 as of 22 Oct 2026
npm install angular-http-server@1.12.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.4
This is the first release that contains the fix.
npm install angular-http-server@1.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of angular-http-server to ensure the security of your application.
Conclusion
The path traversal vulnerability in angular-http-server can have severe consequences, including unauthorized access to sensitive information and remote code execution. It is crucial to update to version 1.4.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for angular-http-server →
FAQ
angular-http-server is an npm package that provides a simple HTTP server for Angular applications. It allows developers to serve their Angular projects locally during development.
Path traversal is a vulnerability that allows an attacker to access files outside of the intended directory. By manipulating the file path, an attacker can bypass the server's restrictions and retrieve sensitive files from the host system.
This vulnerability can lead to unauthorized access to sensitive information or even remote code execution. An attacker could retrieve confidential data or inject malicious code into the server, compromising the entire system.
To fix this vulnerability, you should update to version 1.4.4 or later of angular-http-server. This version includes a patch that prevents path traversal attacks.
There is no known workaround for this vulnerability. It is essential to update to the latest version of angular-http-server to ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for angular-http-server.
