Directory Traversal in nhouston

Description

All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as ../ to read files outside of the served directory.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-44g9-w23c-5rw7
• www.npmjs.com
• en.wikipedia.org
• snyk.io
• CVE-2014-8883
• CWE-23
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Directory Traversal in isomorphic-git - CVE-2021-30483
• Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory - CVE-2026-30848
• Mammoth is vulnerable to Directory Traversal - CVE-2025-11849
• Directory traversal in rollup-plugin-server - CVE-2020-7686

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

nhouston