{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.7.11"}],"component":"@nubosoftware/node-static","cve_ids":["CVE-2023-26111"],"ecosystem":"npm","epss":0.01445,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-5g97-whc9-8g7j","id":"tcs_01M5KF3NATQVQ10MBYKWVNGQSQ","modified_at":"2025-09-26T21:58:15Z","published_at":"2023-03-06T06:30:18Z","references":["https://osv.dev/vulnerability/GHSA-5g97-whc9-8g7j","https://nvd.nist.gov/vuln/detail/CVE-2023-26111","https://gist.github.com/lirantal/c80b28e7bee148dc287339cb483e42bc","https://github.com/cloudhead/node-static","https://github.com/cloudhead/node-static/blob/master/lib/node-static.js#23L160-L163","https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-3149928","https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5g97-whc9-8g7j#npm/@nubosoftware/node-static","url":"https://osv.dev/vulnerability/GHSA-5g97-whc9-8g7j"}],"summary":"node-static and @nubosoftware/node-static vulnerable to Directory Traversal"}