{"action":"Upgrade serve-static to 1.16.0 or later.","affected":[{"fixed":"1.16.0","introduced":"0"},{"fixed":"2.1.0","introduced":"2.0.0"}],"component":"serve-static","cve_ids":["CVE-2024-43800"],"ecosystem":"npm","epss":0.00631,"exploited":false,"fixed_versions":["1.16.0","2.1.0"],"ghsa_id":"GHSA-cm22-4g7w-348p","id":"tcs_01M5KFK27EZ7WETQZW7CNDM52H","modified_at":"2026-09-10T03:50:18.868190591Z","published_at":"2024-09-10T19:42:33Z","references":["https://osv.dev/vulnerability/GHSA-cm22-4g7w-348p","https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p","https://nvd.nist.gov/vuln/detail/CVE-2024-43800","https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa","https://github.com/expressjs/serve-static"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"GHSA-cm22-4g7w-348p","url":"https://osv.dev/vulnerability/GHSA-cm22-4g7w-348p"}],"summary":"serve-static vulnerable to template injection that can lead to XSS"}