Home

Description

This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.

PUBLISHED Reserved 2025-09-29 | Published 2025-09-30 | Updated 2025-09-30 | Assigner snyk




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R

Problem types

Denial of Service (DoS)

Product status

Any version before *
affected

Any version before *
affected

Credits

Unknown

References

security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183

security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3330728

github.com/...ommit/78879dc665f0f7137063794b6e0b6203a81c7f67

cve.org (CVE-2025-11149)

nvd.nist.gov (CVE-2025-11149)

Download JSON