CVE-2019-10775: Denial of Service in ecstatic
Summary
CVE-2019-10775: Denial of Service in ecstatic. Affects ecstatic versions < 4.1.3. Fixed in 4.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ecstatic is an npm package that provides a simple and efficient static file server for Node.js. It is commonly used to serve static files for web applications. However, ecstatic is vulnerable to a denial of service (DoS) attack. This means that an attacker can exploit this vulnerability to crash an application that uses ecstatic as its static file server.
Vulnerability Detail
The vulnerability in ecstatic arises from a flaw in its code. By sending specially crafted requests to the server, an attacker can trigger a crash in the application. This can lead to service disruption and potential loss of data. The vulnerability has been assigned the identifier CVE-2019-10775.
How To Fix
Latest published version: 4.1.4 as of 22 Oct 2026
npm install ecstatic@4.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.3
This is the first release that contains the fix.
npm install ecstatic@4.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update to the fixed version, a temporary workaround is to disable the use of ecstatic as the static file server in your application. Instead, you can consider using an alternative package or implementing your own static file server with appropriate security measures.
Conclusion
The vulnerability in ecstatic can lead to a denial of service attack, causing an application to crash. It is crucial to update to version 4.1.3 or later to mitigate this risk. If immediate updating is not possible, consider using an alternative package or implementing a custom static file server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ecstatic →
FAQ
The vulnerability allows an attacker to crash an application that uses ecstatic as its static file server. This can result in service disruption and potential loss of data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
While the details of any known exploits for this vulnerability are not disclosed, it is important to promptly update to the fixed version to mitigate the risk of exploitation.
If you are unable to immediately update to the fixed version, you can disable the use of ecstatic as the static file server in your application. This will help mitigate the risk of exploitation until you are able to update.
There is no evidence of this vulnerability being actively exploited at this time. However, it is still important to update to the fixed version to ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for ecstatic.
