CVE-2015-1164: Open Redirect in serve-static
Summary
CVE-2015-1164: Open Redirect in serve-static. Affects serve-static across 2 version ranges.
>= 1.7.0, < 1.7.2
< 1.7.2
Fixed in 1.7.2. How to fix ↓
Also tracked for
- node-serve-static · Debian:11
The same CVE-2015-1164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
serve-static is an npm package that provides a middleware function for serving static files in Node.js applications. It allows developers to easily serve static content, such as HTML, CSS, and JavaScript files, from a specified directory. However, versions prior to 1.6.5 (or 1.7.x prior to 1.7.2) of serve-static are vulnerable to an open redirect vulnerability when configured to mount at the root directory.
Vulnerability Detail
The open redirect vulnerability in serve-static allows an attacker to craft a malicious URL that can redirect users to an external website. By exploiting this vulnerability, an attacker can trick users into visiting a malicious website, potentially leading to further attacks, such as phishing or the execution of malicious scripts. The vulnerability occurs when the serve-static middleware is configured to serve files from the root directory and fails to properly validate and sanitize user-supplied input.
How To Fix
Latest published version: 2.2.1 as of 22 Oct 2026
npm install serve-static@2.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.2
This is the first release that contains the fix.
npm install serve-static@1.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating serve-static is not immediately feasible, a temporary workaround is to avoid configuring serve-static to mount at the root directory. Instead, specify a subdirectory as the mount point for serve-static. This reduces the risk of the open redirect vulnerability being exploited.
Conclusion
The open redirect vulnerability in serve-static can be mitigated by updating to the latest version or by avoiding the configuration of serve-static to mount at the root directory. It is important to promptly address this vulnerability to prevent potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for serve-static →
FAQ
An open redirect vulnerability is a security flaw that allows an attacker to redirect users to a different website, potentially leading to phishing attacks or the execution of malicious scripts.
An attacker can exploit this vulnerability by crafting a malicious URL that, when clicked by a user, redirects them to an external website controlled by the attacker.
The potential consequences of this vulnerability include users being tricked into visiting malicious websites, which can lead to further attacks such as phishing or the execution of malicious scripts.
Versions prior to 1.6.5 (or 1.7.x prior to 1.7.2) of serve-static are affected by this vulnerability.
To mitigate the risk of this vulnerability, it is recommended to update serve-static to the latest version as soon as possible. If immediate updating is not feasible, avoid configuring serve-static to mount at the root directory.
Related vulnerabilities
Recent vulnerabilities recorded for serve-static.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
