Junglewise Threat Intelligence

node-static denial of service via null byte in path

Severity: info · Published 2021-09-22

Executive brief

node-static is a popular Node.js package for serving static files over HTTP. The package fails to properly validate file paths, allowing attackers to crash the server by requesting URLs containing null bytes (e.g., `/%00`). This causes service unavailability and potential operational disruption.

Technical details

node-static fails to sanitize null bytes in user-supplied file paths before passing them to fs.stat(), triggering an unhandled TypeError exception. The vulnerability is a missing input validation on HTTP request paths that contain the NULL character (U+0000). An unauthenticated attacker can remotely exploit this via a crafted HTTP request to a server running the affected package, causing the process to crash and deny service to legitimate users. No authentication or user interaction is required. The fix involves validating and rejecting paths containing null bytes before file system operations.

Affected products

  • node-static node-static 0.7.11 and earlier

Timeline

  • 2021-09-22: disclosed
  • 2019-01-11: other: Fix proposed via pull request #213

References