Is serve-static 1.6 vulnerable?

npm · 6 releases from 1.6.0 to 1.6.5 · latest serve-static is 2.2.1 · checked 2 Nov 2026

Yes: 2 known advisories

Yes. serve-static 1.6.5, the last 1.6 release, is affected by 2 known security advisories (2 low), including CVE-2024-43800, CVE-2015-1164. Upgrade to 1.16.0 or later to fix all of them.

Upgrade with:npm install serve-static@1.16.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting serve-static 1.6.5

  • LowCVE-2024-43800GHSA-cm22-4g7w-348p10 Sept 2024

    serve-static vulnerable to template injection that can lead to XSS

    Affected
    <1.16.0 · >=2.0.0 <2.1.0
    Fixed in
    1.16.0, 2.1.0
  • LowCVE-2015-1164GHSA-c3x7-gjmx-r2ff31 Aug 2020

    Open Redirect in serve-static

    Affected
    <1.7.2 · >=1.7.0 <1.7.2
    Fixed in
    1.7.2

Which of your client projects are still on serve-static 1.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact serve-static version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other serve-static versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.