Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
expressjs/serve-static
master @ 74be78a
2
Fixes
2
CVEs
MEDIUM
Peak severity
Highlights
Cross-Site Scripting (XSS): 1 prior fix. Scrutinize any change in this area.
index.js: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cross-Site Scripting (XSS): Directory redirect responses write HTML payloads containing untrusted path input directly to the response stream. Inadequate Content-Security-Policy (CSP) headers previously allowed execution of injected scripts in these redirect bodies, leading to Reflected XSS.
Open Redirect: Improper handling of double slashes (//) and PATH_INFO when the middleware is mounted at the root directory allows attackers to craft redirect targets pointing to external malicious domains.