Executive brief
Vercel's serve module is a Node.js package used to serve static files and list directories from a web server. An attacker can bypass file access restrictions by URL-encoding the filename, allowing access to files that should be restricted from serving. This could expose sensitive files that were meant to be protected.
Technical details
The serve module improperly handles URL-encoded filenames, failing to properly decode and validate file access restrictions before serving content. This is a CWE-177 (Improper Handling of URL Encoding) vulnerability where URL-encoded characters bypass the intended blocklist or access control checks. An attacker can send HTTP requests with URL-encoded filenames to access files that should be restricted—for example, encoding dots or slashes to traverse directories or access ignored files. The attack requires network access and no authentication, making it directly exploitable. The vulnerability was patched in version 6.5.2; users should upgrade from affected versions (all versions prior to 6.5.2).
Affected products
- Vercel serve before 6.5.2
Timeline
- 2018-06-07: disclosed: NVD published
- 2021-08-09: advisory: GHSA advisory published
- 2021-08-09: patched: Fixed in version 6.5.2