Repository navigation
[SECURITY] CVE-2025-11149: Null Byte Causes Server Crash #244
Description
CVE-2025-11149 affects all versions of node-static. The package fails to catch exceptions when user input includes null bytes, allowing attackers to crash the server with requests like http://host/%00.
References
https://nvd.nist.gov/vuln/detail/CVE-2025-11149
https://security-tracker.debian.org/tracker/CVE-2025-11149
78879dc
Activity
brettz9 commentedon Oct 15, 2025
Thank you for the report. I believe this should already be fixed in
master, but we are awaiting a possible transfer of ownership in order to get out a release.brettz9 commentedon Oct 15, 2025
Closing as we can track the need for an npm release in #231 .
peterbernhardt commentedon Oct 16, 2025
@brettz9 when can we expect a new release?
brettz9 commentedon Oct 16, 2025
See my comment at #231 . Thanks!