{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.7.11"}],"component":"@nubosoftware/node-static","cve_ids":["CVE-2025-11149"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-27w5-gj5q-82fv","id":"tcs_01M5KESD2RZZKFQX4XKNBV4A3Z","modified_at":"2025-10-03T18:26:44Z","published_at":"2025-09-30T12:30:51Z","references":["https://osv.dev/vulnerability/GHSA-27w5-gj5q-82fv","https://nvd.nist.gov/vuln/detail/CVE-2025-11149","https://github.com/github/advisory-database/pull/6248","https://github.com/cloudhead/node-static/commit/78879dc665f0f7137063794b6e0b6203a81c7f67","https://github.com/cloudhead/node-static","https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183","https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3330728"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-27w5-gj5q-82fv","url":"https://osv.dev/vulnerability/GHSA-27w5-gj5q-82fv"}],"summary":"@nubosoftware/node-static failure to catch exception can result in server crash"}