What is GHSA-5g97-whc9-8g7j?

GHSA-5g97-whc9-8g7j is a security advisory published by GitHub Security Advisories with High severity. node-static and @nubosoftware/node-static vulnerable to Directory Traversal

Which CVE IDs does GHSA-5g97-whc9-8g7j cover?

GHSA-5g97-whc9-8g7j covers the following CVE IDs: CVE-2023-26111. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5g97-whc9-8g7j?

GHSA-5g97-whc9-8g7j has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-5g97-whc9-8g7j?

GHSA-5g97-whc9-8g7j affects 2 products, including: npm/node-static:\u003c= 0.7.11; npm/@nubosoftware/node-static:\u003c= 0.7.11.

GHSA-5g97-whc9-8g7jHighCVSS 7.5

node-static and @nubosoftware/node-static vulnerable to Directory Traversal

Vendor

GitHub Security Advisories

Published

March 6, 2023

Last Modified

September 26, 2025

🔗 CVE IDs covered (1)

CVE-2023-26111 →

📋 Description

node-static and its fork, @nubosoftware/node-static, are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.

🎯 Affected products2

npm/node-static:<= 0.7.11
npm/@nubosoftware/node-static:<= 0.7.11

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2023-26111
https://gist.github.com/lirantal/c80b28e7bee148dc287339cb483e42bc
https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-3149928
https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927
https://github.com/cloudhead/node-static/blob/master/lib/node-static.js#23L160-L163
https://github.com/advisories/GHSA-5g97-whc9-8g7j