# CVE-2019-5417: serve directory traversal

Source: https://junglewise.ai/threats/cve-2019-5417-serve-directory-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-03-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-5417 · Severity: low · CVSS 3 · Published 2019-03-25

serve is a popular Node.js package used to serve static files and directories over HTTP. The vulnerability allows attackers to bypass file access restrictions and read arbitrary files from the server's filesystem through directory traversal attacks, potentially exposing sensitive configuration files, credentials, or other protected system files.

Technologies: [serve (npm)](https://junglewise.ai/threats/technologies/serve). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-5417 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-5417 being exploited in the wild.

**How severe is CVE-2019-5417?** Low severity, with a CVSS score of 3, published 25 March 2019.

**Which products and versions are affected?** serve (npm) before 7.1.3.

**Is there a fix for CVE-2019-5417?** A patch was published on 2019: Version 7.1.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-5417 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-5417?** Check whether you run serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability (CWE-22) exists in serve versions prior to 7.1.3 where file path inputs are not properly sanitized. An attacker can craft malicious file paths using sequences like "../" to traverse up the directory tree and access files outside the intended serving directory. The vulnerability is remotely exploitable without authentication or user interaction. An attacker with network access to the serve instance can read arbitrary files accessible to the process, potentially leading to information disclosure of configuration files, private keys, or other sensitive data. Fixed in serve 7.1.3 and later.

## Affected products

- npm serve before 7.1.3

## Identifiers

- CVE-2019-5417
- GHSA-xg75-3277-gvvj

## Timeline

- 2019-03-25: disclosed
- 2019: patched: Version 7.1.3 released

## References

- [https://hackerone.com/reports/358645](https://hackerone.com/reports/358645)

## Related threats

- [Vercel serve path traversal via URL encoding](https://junglewise.ai/threats/cve-2018-3718-vercel-serve-path-traversal-via-url-encoding)
- [serve Cross-Site Scripting in filename handling](https://junglewise.ai/threats/serve-cross-site-scripting-in-filename-handling-f9ba227e)
- [serve cross-site scripting in directory listing](https://junglewise.ai/threats/serve-cross-site-scripting-in-directory-listing-bd56c0df)
- [serve Path Traversal via explicitly ignored folders](https://junglewise.ai/threats/serve-path-traversal-via-explicitly-ignored-folders-70a1a073)
- [serve path validation bypass via URL encoding](https://junglewise.ai/threats/serve-path-validation-bypass-via-url-encoding-c91ec671)