Denial of Service in node-static · GHSA-8r4g-cg4m-x23c · GitHub Advisory Database · GitHub

Denial of Service in node-static

Moderate severity GitHub Reviewed Published Sep 22, 2021 to the GitHub Advisory Database • Updated Oct 3, 2025

Package

node-static (npm)

Affected versions

<= 0.7.11

Patched versions

None

Description

All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.

References

Reviewed Sep 22, 2021

Published to the GitHub Advisory Database Sep 22, 2021

Last updated Oct 3, 2025

Weaknesses

CWE-248

Uncaught Exception

An exception is thrown from a function, but it is not caught. Learn more on MITRE.

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Learn more on MITRE.