# CVE-2017-16097: tiny-http directory traversal

Source: https://junglewise.ai/threats/cve-2017-16097-tiny-http-directory-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16097 · Severity: low · CVSS 3 · Published 2020-09-01

tiny-http is a lightweight HTTP server library used in Node.js applications. An attacker can exploit a directory traversal vulnerability to read arbitrary files outside the intended server root directory, potentially exposing sensitive files like private keys, configuration files, or system passwords.

Technologies: [Tiny-Http](https://junglewise.ai/threats/technologies/tiny-http). Vendors: [Tiny-Http](https://junglewise.ai/threats/vendors/tiny-http).

## Quick answers

**Is CVE-2017-16097 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16097 being exploited in the wild.

**How severe is CVE-2017-16097?** Low severity, with a CVSS score of 3, published 1 September 2020.

**Which products and versions are affected?** Tiny-Http All versions (0.0.0 and later).

**Is there a fix for CVE-2017-16097?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-16097 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-16097?** Check whether you run Tiny-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a classic directory traversal (CWE-22) in the file path resolution logic of tiny-http. The server fails to properly sanitize or validate relative path traversal sequences (e.g., "../") in HTTP requests, allowing an attacker to navigate outside the intended document root. An unauthenticated attacker on the network can craft a simple GET request with traversal sequences (e.g., GET /../../etc/passwd) to read arbitrary files with the privileges of the server process. No patch is available; the maintainers recommend the package be used only for local development.

## Affected products

- tiny-http tiny-http All versions (0.0.0 and later)

## Identifiers

- CVE-2017-16097
- GHSA-cch6-5x4h-6qc5

## Timeline

- 2017: disclosed: CVE-2017-16097 assigned
- 2020-09-01: advisory: GHSA-cch6-5x4h-6qc5 published

## References

- [https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tiny-http](https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tiny-http)

## Related threats

- [tiny-http HTTP header injection in header parsing and serialization](https://junglewise.ai/threats/cve-2026-66753-tiny-http-http-header-injection-in-header-parsing-and)
- [tiny-http HTTP request smuggling via Transfer-Encoding handling](https://junglewise.ai/threats/cve-2026-66752-tiny-http-http-request-smuggling-via-transfer-encoding-handling)