vercel/serve allows access to restricted files if filename is URL encoded.

MEDIO 5.3CVE-2018-3718 · GHSA-5rc4-8qqh-vq7f · Published 07/06/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
serve zeit	`< 6.5.2`	`6.5.2`
serve npm	`< 6.5.2`	`6.5.2`

Description

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

NVD description

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.