Read the docs
TI-2018-02710 Aliases CVE-2018-3712GHSA-q2qh-cgc2-qhr3

Path traversal in HackerOne serve node module

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.

Why it matters now

EPSS 0.0179 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed serve node module (HackerOne): 6.4.9serve (npm): 6.4.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOneserve node modulebefore 6.4.96.4.9Patch availableCNA
—serve (npm)before 6.4.96.4.9Patch availableGHSA-q2qh-cgc2-qhr3
  • serve node module VendorHackerOne Affected before 6.4.9 Fixed in 6.4.9 Patch available CNA
  • serve (npm) Vendor— Affected before 6.4.9 Fixed in 6.4.9 Patch available GHSA-q2qh-cgc2-qhr3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zeit:serve:*:*:*:*:*:node.js:*:*before 6.4.9Vulnerablezeit
  • cpe:2.3:a:zeit:serve:*:*:*:*:*:node.js:*:* Versions before 6.4.9 Vulnerable ·zeit

Remediation

  • Fix · CNA serve node module (HackerOne) Fixed in 6.4.9
  • Fix · GHSA-q2qh-cgc2-qhr3 serve (npm) Fixed in 6.4.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-3712
  2. 2026-10-03 Alias added: GHSA-q2qh-cgc2-qhr3

References

Exploit 1

Advisory 2

Other 2

  • TI-2019-03827 Path traversal in serve CVSS 3.0HIGH 7.5
  • TI-2019-03825 Improper privilege management in serve CVSS 3.1HIGH 7.5
  • TI-2018-02716 serve node module suffers from Improper Handling of URL Encoding by permitting access to… CVSS 3.1MEDIUM 5.3
  • TI-2018-02781 Information exposure through directory listings in serve 6.5.3 allows directory listing… CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences