Open Redirect Vulnerability in ecstatic
Summary
GHSA-9q64-mpxx-87fg: Open Redirect in ecstatic. Affects ecstatic across 3 version ranges.
< 2.2.2
>= 3.0.0, < 3.3.2
>= 4.0.0, < 4.1.2
Fixed in 2.2.2, 3.3.2 or 4.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ecstatic is an npm package that provides a simple static file server for serving static assets. It is commonly used in web applications to serve static files such as HTML, CSS, and JavaScript. However, versions of ecstatic prior to 4.1.2, 3.3.2, or 2.2.2 are vulnerable to an Open Redirect vulnerability. This vulnerability allows attackers to craft requests that result in an HTTP 301 redirect to any other domain.
Vulnerability Detail
The Open Redirect vulnerability in ecstatic arises from the package's failure to properly validate redirects. Attackers can exploit this vulnerability by crafting malicious requests that trick the server into redirecting the user to a different domain. This can be used for phishing attacks, where the attacker tricks the user into visiting a malicious website by disguising it as a legitimate one. The impact of this vulnerability can range from unauthorized access to sensitive information to the installation of malware on the user's system.
How To Fix
Latest published version: 4.1.4 as of 22 Oct 2026
npm install ecstatic@4.1.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.22.2.2npm install ecstatic@2.2.2 -
>= 3.0.0, < 3.3.23.3.2npm install ecstatic@3.3.2 -
>= 4.0.0, < 4.1.24.1.2npm install ecstatic@4.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions of ecstatic to address the issue.
Conclusion
The Open Redirect vulnerability in ecstatic can have serious security implications, including unauthorized access to sensitive information and the potential for phishing attacks. It is crucial to update to the fixed versions of ecstatic (4.1.2 or later for 4.x, 3.3.2 or later for 3.x, and 2.2.2 or later for 2.x) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ecstatic →
FAQ
An Open Redirect vulnerability allows attackers to craft requests that trick the server into redirecting the user to a different domain. This can be exploited for phishing attacks or to redirect users to malicious websites.
The consequences of this vulnerability can include unauthorized access to sensitive information, phishing attacks, and the installation of malware on the user's system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
There are no known workarounds for this vulnerability. It is essential to update to the fixed versions of ecstatic to mitigate the risk.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/04/GHSA-9q64-mpxx-87fg/GHSA-9q64-mpxx-87fg.json
References
Related vulnerabilities
Recent vulnerabilities recorded for ecstatic.
