Low severityNVD Advisory· Published Jan 21, 2015· Updated Jun 17, 2026
CVE-2015-1164
CVE-2015-1164
Description
Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
serve-staticnpm | < 1.7.2 | 1.7.2 |
serve-staticnpm | >= 1.7.0, < 1.7.2 | 1.7.2 |
Affected products
2- cpe:2.3:a:serve-static_project:serve-static:*:*:*:*:*:node.js:*:*Range: <=1.7.1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-c3x7-gjmx-r2ffghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2015-1164ghsaADVISORY
- www.securityfocus.com/bid/72064nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/99936nvdWEB
- github.com/expressjs/serve-static/issues/26nvdWEB
- snyk.io/vuln/npm:serve-static:20150113ghsaWEB
- www.npmjs.com/advisories/35ghsaWEB
- nodesecurity.io/advisories/serve-static-open-redirectnvd
News mentions
0No linked articles in our index yet.