GHSA-wm77-q74p-5763
Path Traversal in superstatic
Affected of superstatic are vulnerable to path traversal when used on Windows.
Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms (a known example being Node.js v9.9.0).
Recommendation
Update to version 5.0.2 or later.
What each source reports
GitHub AdvisoriesNo score
Path Traversal in superstatic
Affected of superstatic are vulnerable to path traversal when used on Windows.
Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms (a known example being Node.js v9.9.0).
Recommendation
Update to version 5.0.2 or later.
- Record
GHSA-wm77-q74p-5763- Weakness
- CWE-177
- Updated
- 2026-11-02
OSVNo score
Path Traversal in superstatic
Affected of superstatic are vulnerable to path traversal when used on Windows.
Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms (a known example being Node.js v9.9.0).
Recommendation
Update to version 5.0.2 or later.
- Record
GHSA-wm77-q74p-5763- Weakness
- CWE-177
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
superstaticnpm | before 5.0.2 | 5.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wm77-q74p-5763 is a vulnerability with no CVSS score yet in superstatic, published July 27, 2018. No source lists public exploit code. Fixed in superstatic 5.0.2.