PT-2025-39959 · Unknown+1 · Node-Static+2

Unknown · Published 2021-09-22 · Updated 2025-10-05 · CVE-2025-11149

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions node-static (affected versions not specified) @nubosoftware/node-static (affected versions not specified)

Description The software does not properly handle user input containing null bytes. This can allow attackers to access http://host/%00 and cause the server to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-248

CWE-400

Related Identifiers

CVE-2025-11149

GHSA-27W5-GJ5Q-82FV

GHSA-8R4G-CG4M-X23C

Affected Products

@Nubosoftware/Node-Static

Debian

Node-Static

References · 25

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11149 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11149 · Security Note
• https://security-tracker.debian.org/tracker/source-package/node-static · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11149 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-11149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-27w5-gj5q-82fv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8r4g-cg4m-x23c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11149 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11149 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11149 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11149 · Vendor Advisory
• https://github.com/github/advisory-database/pull/6248 · Note
• https://github.com/cloudhead/node-static/pull/213 · Note
• https://github.com/cloudhead/node-static/blob/643a528ec7bbd05a59c4030655d94810570afb3f/CHANGES.md#-unreleased · Note
• https://github.com/cloudhead/node-static · Note