CVE-2023-26152: static-server Path Traversal vulnerability

October 3, 2023 (updated September 26, 2025)

All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.

References

gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d
github.com/advisories/GHSA-v834-rhv4-65m3
github.com/nbluis/static-server
github.com/nbluis/static-server/blob/master/server.js
nvd.nist.gov/vuln/detail/CVE-2023-26152
security.snyk.io/vuln/SNYK-JS-STATICSERVER-5722341

Code Behaviors & Features

Detect and mitigate CVE-2023-26152 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →