NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
LOW severity

CVE-2015-1164 — serve-static

LOW

CVE-2015-1164 is a low-severity (CVSS 3.1) vulnerability in serve-static. A fix is available for serve-static — see the affected versions and patch details below.

Open Redirect in serve-static

Also known asGHSA-c3x7-gjmx-r2ff
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 25, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs85th percentile — riskier than 85% of all scored CVEsHighest risk
0.00%1.10%2.21%3.31%0.3%2.6%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

4Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
serve-staticnpm
112.1Mdownloads / week

Description

Versions of serve-static prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.

Proof of Concept

A link to http://example.com//www.google.com/%2e%2e will redirect to //www.google.com/%2e%2e

Some browsers will interpret this as http://www.google.com/%2e%2e, resulting in an external redirect.

Recommendation

Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmserve-staticall versions1.7.2npm install serve-static@1.7.2
📦npmserve-static≥ 1.7.0&&< 1.7.21.7.2npm install serve-static@1.7.2

Affected Products

1 product · 1 configurations
Application
serve-staticserve-static_project
≤ 1.7.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for serve-static, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update serve-static to 1.7.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2015-1164 is resolved across your whole dependency graph.

  3. Workarounds

    Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.

Frequently Asked Questions

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory. ## Proof of Concept A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e` Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect. ## Recommendation Version 1.7.x: Update to version 1.7.2 or later. Version 1.6.x: Update to version 1.6.5 or later.
O3 Security · Impact-Aware SCA

Is CVE-2015-1164 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2015-1164: serve-static Open Redirect — Fixed in 1.7.2