[Snyk] Upgrade http-server from 0.10.0 to 0.13.0 by karencapiiro · Pull Request #366 · Rashdamada/react

karencapiiro · 2026-07-09T10:51:17Z

Snyk has created this PR to upgrade http-server from 0.10.0 to 0.13.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 8 versions ahead of your current version.
The recommended version was released 5 years ago.

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Denial of Service (DoS) SNYK-JS-ECSTATIC-540354	300	Proof of Concept
Prototype Override Protection Bypass npm:qs:20170213	300	No Known Exploit
Denial of Service (DoS) SNYK-JS-HTTPPROXY-569139	300	Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade http-server from 0.10.0 to 0.13.0. See this package in yarn: http-server See this project in Snyk: https://app.snyk.io/org/apiiro-snyk/project/2635ecd0-4486-4847-96e6-94b5c23f402f?utm_source=github&utm_medium=referral&page=upgrade-pr

karencapiiro · 2026-07-09T10:51:18Z

This upgrade spans several versions and introduces notable changes, including dropping support for older Node.js versions and internal refactoring.

Breaking Changes & Key Updates:

Node.js Support: Support for Node.js versions below 6.0 was dropped in v0.12.0. If you are using an older Node.js runtime, you must upgrade.
Internal Refactor: Version v0.13.0 removes the dependency on the abandoned ecstatic library and internalizes its functionality. While intended to be a major achievement, this could introduce subtle behavioral changes.
Header Changes: As of v0.13.0, the server: http-server-${version} header is no longer sent with every response.

Recommendation:
Given the drop in Node.js support and the significant internal refactoring, this upgrade carries a medium risk. It is crucial to verify that your application is running on a supported Node.js version (6.0 or newer) and to perform thorough regression testing to ensure that the server's behavior, especially regarding static file serving and directory listings, remains consistent after the upgrade.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

socket-security · 2026-07-09T10:53:01Z

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

martinSaad · 2026-07-09T10:55:51Z

⛔ Snyk checks have failed. 402 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (402)
⛔	Open Source Security	27	240	114	21	402 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

karencapiiro · 2026-07-09T11:03:26Z

Checkmarx One – Scan Summary & Details – 565cd013-b0d4-44c9-9282-9c2b0e71ea7c

New Issues (412)

Critical: 32 · High: 214 · Medium: 132 · Low: 34

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	CVE-2026-0905	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Insufficient policy enforcement in the Network in Google Chrome prior to 144.0.7559.59 allowed an attacker who obtained a network log file to poten... Attack Vector: NETWORK Attack Complexity: LOW `ID: xdBIIJTSFOk0hBrfhOHtOT5rLfbl9ysgbxaou0OPmCY%3D` Vulnerable Package
2	CVE-2026-0906	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) ... Attack Vector: NETWORK Attack Complexity: LOW `ID: w2iuwEKd4RdG81EFBLZPhr68PLicCdRAakWn%2B11dWo8%3D` Vulnerable Package
3	CVE-2026-0907	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Attack Vector: NETWORK Attack Complexity: LOW `ID: Rfi9%2FKEsrWzKLBp91GAwHKUVY0IOHZaVABR85njh9PA%3D` Vulnerable Package
4	CVE-2026-11671	Npm-electron-23.1.2	details Recommended version: 40.10.5 Description: Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a craft... Attack Vector: NETWORK Attack Complexity: LOW `ID: 809TNko1EJLBvzRKmTiG%2BUhLl0cysxPYxxtt%2Bx6%2Fk1g%3D` Vulnerable Package
5	CVE-2026-1525	Npm-undici-5.20.0	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW `ID: TpflYBIk8490OGA5rSuEskezmSO0ERVFBzAD70JYqQ4%3D` Vulnerable Package
6	CVE-2026-1525	Npm-undici-5.22.1	details Recommended version: 6.24.0 Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v... Attack Vector: NETWORK Attack Complexity: LOW `ID: ap9N0cZwfXoDD20aKRGSeYeunDg6ZTXeXQWVcU0o1xs%3D` Vulnerable Package
7	CVE-2026-3061	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafte... Attack Vector: NETWORK Attack Complexity: LOW `ID: o56T7mPrvTG2MpJ61F%2FxFBOL%2BVU2LZhlPFqFx%2Fk8Bl0%3D` Vulnerable Package
8	CVE-2026-3062	Npm-electron-23.1.2	details Recommended version: 41.0.0 Description: Out-of-bounds Read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory acce... Attack Vector: NETWORK Attack Complexity: LOW `ID: VYDXWYSruEk467ryMio4PwRtCyS4I9GeJiV1DYKzWGU%3D` Vulnerable Package
9	CVE-2026-33896	Npm-node-forge-0.10.0	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: zA6%2FleD8HqlGm0ZM50jl04NLbMqmb1%2BnkXC5rOyHO2E%3D` Vulnerable Package
10	CVE-2026-33896	Npm-node-forge-0.7.6	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: MiFqY2YBEgzOAK3Uhb%2FE%2F1d9gLCaB1%2FLTQXjVmGIZdc%3D` Vulnerable Package
11	CVE-2026-33896	Npm-node-forge-1.3.1	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: HLwxnjtOdkKq1OrabRHdJhrVjAyfCyrKFD593rJK4jE%3D` Vulnerable Package
12	CVE-2026-33896	Npm-node-forge-0.6.33	details Recommended version: 1.4.0 Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr... Attack Vector: NETWORK Attack Complexity: LOW `ID: nO2W8QzFSHn5Z6u9uIDdmTC7oIGnsxX8KNNb6R0RBIg%3D` Vulnerable Package
13	CVE-2026-33937	Npm-handlebars-4.7.6	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: lSRwz2%2BXy4NbFUTojZw7vmmrClCizlywTJNVTf5euwM%3D` Vulnerable Package
14	CVE-2026-33937	Npm-handlebars-4.7.7	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: SzxbxexCAty0UMTOe5v0UZO3aUFiz%2Btp0A2Eop5T59Q%3D` Vulnerable Package
15	CVE-2026-33937	Npm-handlebars-4.5.3	details Recommended version: 4.7.9 Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr... Attack Vector: NETWORK Attack Complexity: LOW `ID: gjQw8sPWBbc0NPFOXhn7GFkbOEnCpPn98wG6Nq8J5lA%3D` Vulnerable Package
16	CVE-2026-34775	Npm-electron-23.1.2	details Recommended version: 38.8.6 Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39.... Attack Vector: NETWORK Attack Complexity: LOW `ID: 5b9mdNbCI0Tu1GcTDrb5kIKmiHHSGhggDlIrqMUAtJU%3D` Vulnerable Package
17	CVE-2026-3545	Npm-electron-23.1.2	details Recommended version: 40.10.6 Description: Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox esca... Attack Vector: NETWORK Attack Complexity: LOW `ID: ijf%2BwuQSj6LRUcwmLCUtW7n%2FOuqiVJY0NXF03PCv6Uo%3D` Vulnerable Package
18	CVE-2026-3916	Npm-electron-23.1.2	details Recommended version: 41.0.1 Description: Out-of-bounds Read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a cr... Attack Vector: NETWORK Attack Complexity: LOW `ID: SZZaK9HceOBOnavwfT1GLcNVLHvGu4hXYNi4c0tVZjw%3D` Vulnerable Package
19	CVE-2026-4800	Npm-lodash-4.17.21	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: Jmm9KhWyDHSAA3VWfc6TXq9MtWSbUi0apRquT6Up4Q8%3D` Vulnerable Package
20	CVE-2026-4800	Npm-lodash-4.17.20	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: h0qcESzV3JBKgrjzDLlHZINwES0rZMfJ5c%2Ft%2Fit16IA%3D` Vulnerable Package
21	CVE-2026-4800	Npm-lodash-4.17.11	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: ta0NLNESfHfgOOBK1MHYaxTesrZXlfqjUAcqkbT%2FMVw%3D` Vulnerable Package
22	CVE-2026-4800	Npm-lodash-4.17.4	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: kGUuzhq1%2FTkXIt8TUFzWBp5lesLlRtnbmJvnU7pnFhU%3D` Vulnerable Package
23	CVE-2026-4800	Npm-lodash-4.17.15	details Recommended version: 4.18.0 Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na... Attack Vector: NETWORK Attack Complexity: LOW `ID: sEuBjmernEmRxc6zPZEC6T36Y3YUYLTcJ6rarNo0ebw%3D` Vulnerable Package
24	CVE-2026-5288	Npm-electron-23.1.2	details Recommended version: 41.2.0 Description: Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to... Attack Vector: NETWORK Attack Complexity: LOW `ID: ARIJGqa4GR2YNvyEFz64MP9gnCAuYEyhafmGsmKZDnE%3D` Vulnerable Package
25	CVE-2026-53486	Npm-decompress-4.2.1	details Description: When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes th... Attack Vector: NETWORK Attack Complexity: LOW `ID: YG8NVmIjLXNQC9eIxYjGbdOQv04c94QZEPfMHvRNBUo%3D` Vulnerable Package
26	CVE-2026-59873	Npm-tar-2.2.2	details Recommended version: 7.5.19 Description: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data... Attack Vector: NETWORK Attack Complexity: LOW `ID: A%2F53rXwDtB6H1IizPyv7jnpN3bvB65AGdcBph%2BovDFA%3D` Vulnerable Package
27	CVE-2026-59873	Npm-tar-2.2.1	details Recommended version: 7.5.19 Description: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data... Attack Vector: NETWORK Attack Complexity: LOW `ID: eusWk0O4c30zAt%2FdYmEe4INMitU3SzmSIndq2CBwVoQ%3D` Vulnerable Package
28	CVE-2026-9277	Npm-shell-quote-1.7.3	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW `ID: XONal%2F4V1%2FVAumRm%2Bvu1RvngEjiLa1KwAfq5s7Ve5Sg%3D` Vulnerable Package
29	CVE-2026-9277	Npm-shell-quote-1.8.1	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW `ID: TyFDp8CtoFJHuAhZMZQgfqJwqBbmFn%2FTho3s89Ygp9s%3D` Vulnerable Package
30	CVE-2026-9277	Npm-shell-quote-1.7.1	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW `ID: gRWPc6Ut4E7cy68%2B7nvp5gitkg86x%2FTDojOkSMkM%2B%2FU%3D` Vulnerable Package
31	CVE-2026-9277	Npm-shell-quote-1.6.1	details Recommended version: 1.8.4 Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc... Attack Vector: NETWORK Attack Complexity: LOW `ID: 7Bc3B7U4x28KSu1Z3Nf4v8xkE09PKw4P3jgvkxVTKFQ%3D` Vulnerable Package
32	Cx0a53ef16-dcb9	Npm-react-devtools-shared-0.0.1	details Description: This package was manually inspected by a security researcher and flagged as malicious ### About Classifying malicious packages is an internal proc... `ID: bkVQcS3BfbGqVMPm7rCIJLHEoWERm8sJ35U%2FHpppsN4%3D` Vulnerable Package
33	CVE-2023-1220	Npm-electron-23.1.2	details Recommended version: 24.0.0 Description: Heap-based Buffer Overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to pot... Attack Vector: NETWORK Attack Complexity: LOW `ID: qw5Rv1Ypcf%2Br%2B54Ucw6De7sckskbFAMfMIzlAsAtqZ4%3D` Vulnerable Package
34	CVE-2023-1530	Npm-electron-23.1.2	details Recommended version: 24.0.0 Description: Use after free in PDF in Google Chrome versions prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a craf... Attack Vector: NETWORK Attack Complexity: LOW `ID: hzQidkR0IatBAUWx1iimsxfm%2BW4qwPtv7dXmdc6sRpk%3D` Vulnerable Package
35	CVE-2023-1811	Npm-electron-23.1.2	details Recommended version: 24.0.0 Description: Use after free in Frames in Google Chrome in versions prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific U... Attack Vector: NETWORK Attack Complexity: LOW `ID: 8fDH11hq65vBoEy8UCugj6lp37IpMF1aDdor2JyeRnw%3D` Vulnerable Package
36	CVE-2023-2135	Npm-electron-23.1.2	details Recommended version: 24.1.3 Description: Use After Free in DevTools in Google Chrome in versions prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific p... Attack Vector: NETWORK Attack Complexity: HIGH `ID: uYBGa6dNoCqUVa4%2FieWELBORs34WUxPKnOfX2kza8Rw%3D` Vulnerable Package
37	CVE-2024-52011	Npm-launch-editor-2.6.0	details Recommended version: 2.9.0 Description: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of ... Attack Vector: NETWORK Attack Complexity: LOW `ID: 4XdBFqwIeSHplzgyqM7s5Ia7jj%2FeGilwH5TIxAc%2FEUg%3D` Vulnerable Package
38	CVE-2025-13630	Npm-electron-23.1.2	details Recommended version: 40.0.0 Description: Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Attack Vector: NETWORK Attack Complexity: LOW `ID: eFPoafRrHWvBi0Yk%2F1nGhtuV%2BAbjHrDdpUDTeJUYVXI%3D` Vulnerable Package
39	CVE-2025-13631	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform Privilege Escala... Attack Vector: NETWORK Attack Complexity: LOW `ID: Bnd58W4ZZWVaEaQcRIGfoWy%2BWtkvLJ6tUH3z%2BBafQjs%3D` Vulnerable Package
40	CVE-2025-13633	Npm-electron-23.1.2	details Recommended version: 38.8.0 Description: Use After Free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to... Attack Vector: NETWORK Attack Complexity: LOW `ID: i6125W7ZLzcjFvm14MV3I%2BZubDQ54sWPxzLi5KJBulg%3D` Vulnerable Package

More results are available on the CxOne platform

Fixed Issues (6)

High: 1 · Medium: 5

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CVE-2019-10775~~	Npm-ecstatic-2.2.2
	~~CVE-2025-13466~~	Npm-body-parser-1.18.2
	~~CVE-2025-13466~~	Npm-body-parser-1.19.0
	~~CVE-2025-13466~~	Npm-body-parser-1.20.1
	~~CVE-2025-13466~~	Npm-body-parser-1.19.2
	~~CVE-2025-13466~~	Npm-body-parser-1.20.2

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade http-server from 0.10.0 to 0.13.0#366

[Snyk] Upgrade http-server from 0.10.0 to 0.13.0#366
karencapiiro wants to merge 1 commit into
mainfrom
snyk-upgrade-093b22a3ec8a996b2dfcfe5a8d51e235

karencapiiro commented Jul 9, 2026

Uh oh!

karencapiiro commented Jul 9, 2026

Uh oh!

socket-security Bot commented Jul 9, 2026

Uh oh!

martinSaad commented Jul 9, 2026

Uh oh!

karencapiiro commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

karencapiiro commented Jul 9, 2026

Snyk has created this PR to upgrade http-server from 0.10.0 to 0.13.0.

Issues fixed by the recommended upgrade:

Breaking Change Risk

Uh oh!

karencapiiro commented Jul 9, 2026

Uh oh!

socket-security Bot commented Jul 9, 2026

Uh oh!

martinSaad commented Jul 9, 2026

⛔ Snyk checks have failed. 402 issues have been found so far.

Uh oh!

karencapiiro commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants