VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Oct 8, 2014· Updated May 6, 2026

CVE-2014-6394

CVE-2014-6394

Description

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
sendnpm
< 0.8.40.8.4

Affected products

8
  • Apple Inc./Xcode
    cpe:2.3:a:apple:xcode:7.0:*:*:*:*:*:*:*
  • Joyent/Node.js4 versions
    cpe:2.3:a:joyent:node.js:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:joyent:node.js:*:*:*:*:*:*:*:*range: <=0.8.3
    • cpe:2.3:a:joyent:node.js:0.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:joyent:node.js:0.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:joyent:node.js:0.8.2:*:*:*:*:*:*:*
  • Fedoraproject/Fedora3 versions
    cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*

Patches

1
9c6ca9b2c0b8
https://github.com/visionmedia/sendvia ghsa
commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

18

News mentions

0

No linked articles in our index yet.