{"id":"CVE-2015-1164","aliases":["AZL-45312","DEBIAN-CVE-2015-1164","EUVD-2020-0610","GHSA-c3x7-gjmx-r2ff","UBUNTU-CVE-2015-1164"],"status":"published","title":"Open Redirect in serve-static","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02616,"percentile":0.85551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2015-01-21T15:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"serve-static","fixed_in":["1.6.5","1.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-serve-static","fixed_in":["1.6.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-serve-static","fixed_in":["1.6.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-serve-static","fixed_in":["1.6.4-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-serve-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-2"}]}]},{"source":"osv","ecosystem":"npm","package":"serve-static","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.2"}]}]},{"source":"osv","ecosystem":"npm","package":"serve-static","ranges":[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.7.2"}]}]}],"products":[{"vendor":"serve-static_project","product":"serve-static"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99936","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://github.com/expressjs/serve-static/issues/26","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1181917","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://www.securityfocus.com/bid/72064","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://nodesecurity.io/advisories/serve-static-open-redirect","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://www.npmjs.com/advisories/35","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1164","tags":["web","advisory"]},{"url":"https://snyk.io/vuln/npm:serve-static:20150113","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c3x7-gjmx-r2ff"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1164","tags":["advisory"]},{"url":"https://github.com/expressjs/serve-static","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-1164","tags":["report"]},{"url":"https://nodesecurity.io/advisories/serve-static-open-redirect","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1164","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1164","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","status":"published","published":"2015-01-21T15:00:00Z","modified":"2024-08-06T04:33:20.662Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2020-0610","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","status":"published","published":"2015-01-21T15:00:00Z","modified":"2024-08-06T04:33:20Z","updated_at":"2026-11-03T02:22:16.145787Z"}],"ghsa":[{"id":"GHSA-c3x7-gjmx-r2ff","title":"Open Redirect in serve-static","description":"Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.\n\n\n## Proof of Concept\n\nA link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`\n\nSome browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.\n\n\n## Recommendation\n\nVersion 1.7.x: Update to version 1.7.2 or later.\nVersion 1.6.x: Update to version 1.6.5 or later.","status":"published","published":"2020-08-31T22:57:02Z","modified":"2023-01-09T05:03:33Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2015-1164","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","status":"published","published":"2015-01-21T15:28:37.79Z","modified":"2026-06-17T00:21:53.49Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"GHSA-c3x7-gjmx-r2ff","title":"Open Redirect in serve-static","description":"Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.\n\n\n## Proof of Concept\n\nA link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`\n\nSome browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.\n\n\n## Recommendation\n\nVersion 1.7.x: Update to version 1.7.2 or later.\nVersion 1.6.x: Update to version 1.6.5 or later.","status":"published","published":"2020-08-31T22:57:02Z","modified":"2023-11-08T03:57:49.518349Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"AZL-45312","title":"CVE-2015-1164 affecting package nodejs-nodemon 2.0.3-5","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","status":"published","published":"2015-01-21T15:28:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2015-1164","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","status":"published","published":"2015-01-21T15:28:37Z","modified":"2026-04-10T03:45:04.816805Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1164","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","status":"published","published":"2015-01-21T15:28:37.79Z","modified":"2026-09-09T06:47:21.777704611Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-1164","description":"Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.","status":"withdrawn","published":"2015-01-21T15:28:00Z","modified":"2025-07-16T07:32:34.719869Z","updated_at":"2026-11-02T15:54:09.721803Z"}]}}