{"id":"GHSA-9q64-mpxx-87fg","aliases":[],"status":"published","title":"Open Redirect in ecstatic","description":"Versions of `ecstatic` prior to 4.1.2, 3.3.2 or 2.2.2 are vulnerable to Open Redirect. The package fails to validate redirects, allowing attackers to craft requests that result in an `HTTP 301` redirect to any other domains.\n\n\n## Recommendation\n\nIf using `ecstatic` 4.x, upgrade to 4.1.2 or later.\nIf using `ecstatic` 3.x, upgrade to 3.3.2 or later.\nIf using `ecstatic` 2.x, upgrade to 2.2.2 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2020-04-01T16:35:08Z","modified":"2023-01-09T05:02:18Z","fixes":[{"ecosystem":"npm","package":"ecstatic","fixed_in":["2.2.2","3.3.2","4.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ecstatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ecstatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ecstatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"ecstatic","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"ecstatic","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"ecstatic","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.2"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10775","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/830","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9q64-mpxx-87fg"}],"sources":{"ghsa":[{"id":"GHSA-9q64-mpxx-87fg","title":"Open Redirect in ecstatic","description":"Versions of `ecstatic` prior to 4.1.2, 3.3.2 or 2.2.2 are vulnerable to Open Redirect. The package fails to validate redirects, allowing attackers to craft requests that result in an `HTTP 301` redirect to any other domains.\n\n\n## Recommendation\n\nIf using `ecstatic` 4.x, upgrade to 4.1.2 or later.\nIf using `ecstatic` 3.x, upgrade to 3.3.2 or later.\nIf using `ecstatic` 2.x, upgrade to 2.2.2 or later.","status":"published","published":"2020-04-01T16:35:08Z","modified":"2023-01-09T05:02:18Z","cwes":["CWE-601"],"updated_at":"2026-11-02T14:36:03.040255Z"}],"osv":[{"id":"GHSA-9q64-mpxx-87fg","title":"Open Redirect in ecstatic","description":"Versions of `ecstatic` prior to 4.1.2, 3.3.2 or 2.2.2 are vulnerable to Open Redirect. The package fails to validate redirects, allowing attackers to craft requests that result in an `HTTP 301` redirect to any other domains.\n\n\n## Recommendation\n\nIf using `ecstatic` 4.x, upgrade to 4.1.2 or later.\nIf using `ecstatic` 3.x, upgrade to 3.3.2 or later.\nIf using `ecstatic` 2.x, upgrade to 2.2.2 or later.","status":"published","published":"2020-04-01T16:35:08Z","modified":"2020-12-15T16:51:18Z","cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}