Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-jreh-snyz-7kda

Summary

@nubosoftware/node-static failure to catch exception can result in server crash
This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.

Aliases

alias	CVE-2025-11149

alias	GHSA-27w5-gj5q-82fv

Fixed_packages

Affected_packages

url pkg:npm/node-static@0.5.6

purl pkg:npm/node-static@0.5.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.5.6

url pkg:npm/node-static@0.5.7

purl pkg:npm/node-static@0.5.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.5.7

url pkg:npm/node-static@0.5.8

purl pkg:npm/node-static@0.5.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.5.8

url pkg:npm/node-static@0.5.9

purl pkg:npm/node-static@0.5.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.5.9

url pkg:npm/node-static@0.6.0

purl pkg:npm/node-static@0.6.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.0

url pkg:npm/node-static@0.6.1

purl pkg:npm/node-static@0.6.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.1

url pkg:npm/node-static@0.6.2

purl pkg:npm/node-static@0.6.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.2

url pkg:npm/node-static@0.6.3

purl pkg:npm/node-static@0.6.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.3

url pkg:npm/node-static@0.6.4

purl pkg:npm/node-static@0.6.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.4

url pkg:npm/node-static@0.6.5

purl pkg:npm/node-static@0.6.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.5

url pkg:npm/node-static@0.6.6

purl pkg:npm/node-static@0.6.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.6

url pkg:npm/node-static@0.6.7

purl pkg:npm/node-static@0.6.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.7

url pkg:npm/node-static@0.6.8

purl pkg:npm/node-static@0.6.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.8

url pkg:npm/node-static@0.6.9

purl pkg:npm/node-static@0.6.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.6.9

url pkg:npm/node-static@0.7.0

purl pkg:npm/node-static@0.7.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.0

url pkg:npm/node-static@0.7.1

purl pkg:npm/node-static@0.7.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.1

url pkg:npm/node-static@0.7.2

purl pkg:npm/node-static@0.7.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.2

url pkg:npm/node-static@0.7.3

purl pkg:npm/node-static@0.7.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.3

url pkg:npm/node-static@0.7.4

purl pkg:npm/node-static@0.7.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.4

url pkg:npm/node-static@0.7.5

purl pkg:npm/node-static@0.7.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.5

url pkg:npm/node-static@0.7.6

purl pkg:npm/node-static@0.7.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.6

url pkg:npm/node-static@0.7.7

purl pkg:npm/node-static@0.7.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.7

url pkg:npm/node-static@0.7.8

purl pkg:npm/node-static@0.7.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.8

url pkg:npm/node-static@0.7.9

purl pkg:npm/node-static@0.7.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.9

url pkg:npm/node-static@0.7.10

purl pkg:npm/node-static@0.7.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.10

url pkg:npm/node-static@0.7.11

purl pkg:npm/node-static@0.7.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1126-8m5u-5kbg

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/node-static@0.7.11

url pkg:npm/%40nubosoftware/node-static@0.7.11

purl pkg:npm/%40nubosoftware/node-static@0.7.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-d5qz-j3ts-sqgb

vulnerability	VCID-jreh-snyz-7kda

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540nubosoftware/node-static@0.7.11

References

reference_url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-11149.json

reference_id

reference_type

scores

value	5.3
scoring_system	cvssv3
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-11149.json

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2025-11149

reference_id

reference_type

scores

value	0.00017
scoring_system	epss
scoring_elements	0.04099
published_at	2026-04-16T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.04112
published_at	2026-04-02T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.0413
published_at	2026-04-04T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.04146
published_at	2026-04-07T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.04178
published_at	2026-04-08T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.04192
published_at	2026-04-09T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.04171
published_at	2026-04-11T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.04154
published_at	2026-04-12T12:55:00Z

value	0.00017
scoring_system	epss
scoring_elements	0.04128
published_at	2026-04-13T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2025-11149

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11149
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11149

reference_url

https://github.com/cloudhead/node-static

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/cloudhead/node-static

reference_url

https://github.com/cloudhead/node-static/commit/78879dc665f0f7137063794b6e0b6203a81c7f67

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R

value	HIGH
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-30T19:06:54Z/

url

https://github.com/cloudhead/node-static/commit/78879dc665f0f7137063794b6e0b6203a81c7f67

reference_url

https://github.com/github/advisory-database/pull/6248

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/github/advisory-database/pull/6248

reference_url

https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R

value	HIGH
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-30T19:06:54Z/

url

https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183

reference_url

https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3330728

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-30T19:06:54Z/

url

https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3330728

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117504
reference_id	1117504
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117504

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=2400393
reference_id	2400393
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=2400393

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2025-11149

reference_id

CVE-2025-11149

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2025-11149

reference_url

https://github.com/advisories/GHSA-27w5-gj5q-82fv

reference_id

GHSA-27w5-gj5q-82fv

reference_type

scores

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-27w5-gj5q-82fv

Weaknesses

cwe_id	400
name	Uncontrolled Resource Consumption
description	The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	20
name	Improper Input Validation
description	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Exploits

Severity_range_score 5.3 - 8.9

Exploitability 0.5

Weighted_severity 8.0

Risk_score 4.0

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jreh-snyz-7kda

Vulnerability Instance