# ecstatic open redirect vulnerability

Source: https://junglewise.ai/threats/ecstatic-open-redirect-vulnerability-498cb2d3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-04-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-04-01

ecstatic is a static file server library used in Node.js applications. Versions prior to 4.1.2, 3.3.2, or 2.2.2 fail to validate HTTP redirect destinations, allowing an attacker to craft requests that redirect users to arbitrary external websites. This can be used for phishing attacks or credential harvesting.

Technologies: [ecstatic (npm)](https://junglewise.ai/threats/technologies/ecstatic). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 1 April 2020.

**Which products and versions are affected?** ecstatic (npm) SEMVER:introduced=0,fixed=2.2.2.

**Is there a fix for This vulnerability?** Yes. ecstatic (npm): upgrade to 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run ecstatic (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ecstatic (npm): upgrade to 2.2.2 or later

  ```sh
  npm install ecstatic@2.2.2
  ```


## Technical details

The vulnerability is an open redirect (CWE-601) in ecstatic's HTTP redirect handling. The package fails to validate or sanitize redirect targets, allowing attackers to craft requests that result in HTTP 301 redirects to any external domain. An attacker can exploit this by crafting a malicious URL pointing to an ecstatic-served application and specifying an arbitrary redirect target. No special authentication is required; the attack is network-accessible and can trick users into visiting attacker-controlled sites. Patches are available: upgrade to version 4.1.2 (for 4.x), 3.3.2 (for 3.x), or 2.2.2 (for 2.x).

## Affected products

- ecstatic ecstatic before 2.2.2, 3.0.0 to before 3.3.2, 4.0.0 to before 4.1.2

## Timeline

- 2020-04-01: disclosed

## References

- [https://www.npmjs.com/advisories/830](https://www.npmjs.com/advisories/830)

## Related threats

- [ecstatic denial of service via URL parameter parsing](https://junglewise.ai/threats/cve-2019-10775-ecstatic-denial-of-service-via-url-parameter-parsing)
- [ecstatic open redirect vulnerability](https://junglewise.ai/threats/ecstatic-open-redirect-vulnerability-4eae3a4a)
- [ecstatic denial of service via HTTP headers](https://junglewise.ai/threats/cve-2015-9242-ecstatic-denial-of-service-via-http-headers)
- [ecstatic denial of service via null byte payload](https://junglewise.ai/threats/cve-2016-10703-ecstatic-denial-of-service-via-null-byte-payload)