Information Exposure on Case Insensitive File Systems in serve

MEDIUM 5.3CVE-2018-3809 · GHSA-686g-3xr3-x4x6 · Published 01/06/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
serve zeit	`= 6.5.3`	No fix yet
serve npm	`< 7.0.0`	`7.0.0`

Description

Versions of serve before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems.

Recommendation

Update to version 7.0.0 or later.

NVD description

Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.

References

nvd.nist.gov/vuln/detail/CVE-2018-3809 · ADVISORY
hackerone.com/reports/330650 · WEB
GitHub Advisory GHSA-686g-3xr3-x4x6 · ADVISORY
npmjs.com/advisories/672 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free