PT-2021-24404 · Unknown · Node-Static

Published 2021-09-22 · Updated 2021-09-22

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: node-static versions all

Description: The issue allows attackers to crash the server by accessing a specific URL, http://host/%00, due to the package's failure to catch an exception when user input includes null bytes.

Recommendations: For all versions, consider disabling the handling of user input that includes null bytes as a temporary workaround until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Resource Exhaustion

Weakness Enumeration

CWE-248

CWE-400

Related Identifiers

GHSA-8R4G-CG4M-X23C

Affected Products

Node-Static

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11149 · Security Note
• https://osv.dev/vulnerability/GHSA-8r4g-cg4m-x23c · Vendor Advisory
• https://github.com/github/advisory-database/pull/6248 · Note
• https://github.com/cloudhead/node-static/blob/643a528ec7bbd05a59c4030655d94810570afb3f/CHANGES.md#-unreleased · Note
• https://github.com/cloudhead/node-static/pull/213 · Note
• https://github.com/cloudhead/node-static · Note
• https://npmjs.com/package/node-static · Note
• https://npmjs.com/advisories/1208 · Note
• https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183 · Note