CVE-2025-11149
CVE-2025-11149
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.
CVSS 7.5 · High · EPSS 0.5%
- Published
- Updated
Affected products and versions
node-static
- Versions
- ≥ 0: Affected (semver)
No fix published
@nubosoftware/node-static
- Versions
- ≥ 0: Affected (semver)
No fix published
node-static Debian:12
- Versions
- 0.7.11+~0.7.12-1
- 0.7.11+~0.7.7-1
- 0.7.11+~0.7.7-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-static Debian:13
- Versions
- 0.7.11+~0.7.12-1
- 0.7.11+~0.7.7-1
- 0.7.11+~0.7.7-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
@nubosoftware/node-static npm
- Affected ranges
- SEMVER: ≤ 0.7.11
No fix published
node-static Ubuntu:16.04:LTS
- Versions
- 0.7.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-static Ubuntu:18.04:LTS
- Versions
- 0.7.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-static Ubuntu:20.04:LTS
- Versions
- 0.7.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-static Ubuntu:22.04:LTS
- Versions
- 0.7.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-static Ubuntu:24.04:LTS
- Versions
- 0.7.11+~0.7.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-static Ubuntu:25.10
- Versions
- 0.7.11+~0.7.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-static Ubuntu:26.04:LTS
- Versions
- 0.7.11+~0.7.7-1
- 0.7.11+~0.7.7-2
- 0.7.11+~0.7.12-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published