CVE-2023-26111: @nubosoftware/node-Static Project @nubosoftware/node-Static

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.

Affected products

• @nubosoftware/node-Static Project @nubosoftware/node-Static: affected versions not specified
• Node-Static Project Node-Static: affected versions not specified

Published 2023-03-06. Last modified 2026-06-17.