Skip to content

[Snyk] Upgrade http-server from 0.10.0 to 0.13.0#366

Open
karencapiiro wants to merge 1 commit into
mainfrom
snyk-upgrade-093b22a3ec8a996b2dfcfe5a8d51e235
Open

[Snyk] Upgrade http-server from 0.10.0 to 0.13.0#366
karencapiiro wants to merge 1 commit into
mainfrom
snyk-upgrade-093b22a3ec8a996b2dfcfe5a8d51e235

Conversation

@karencapiiro

@karencapiiro karencapiiro commented Jul 9, 2026

Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to upgrade http-server from 0.10.0 to 0.13.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 8 versions ahead of your current version.

  • The recommended version was released 5 years ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Denial of Service (DoS)
SNYK-JS-ECSTATIC-540354		 300 Proof of Concept
high severity Prototype Override Protection Bypass
npm:qs:20170213		 300 No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JS-HTTPPROXY-569139		 300 Proof of Concept

Breaking Change Risk

Merge Risk: Medium

Notice: This assessment is enhanced by AI.

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
fix: upgrade http-server from 0.10.0 to 0.13.0
9d06753 
Snyk has created this PR to upgrade http-server from 0.10.0 to 0.13.0.

See this package in yarn:
http-server

See this project in Snyk:
https://app.snyk.io/org/apiiro-snyk/project/2635ecd0-4486-4847-96e6-94b5c23f402f?utm_source=github&utm_medium=referral&page=upgrade-pr
@karencapiiro

karencapiiro commented Jul 9, 2026

Copy link
Copy Markdown
Author

Merge Risk: Medium

This upgrade spans several versions and introduces notable changes, including dropping support for older Node.js versions and internal refactoring.

Breaking Changes & Key Updates:

  • Node.js Support: Support for Node.js versions below 6.0 was dropped in v0.12.0. If you are using an older Node.js runtime, you must upgrade.
  • Internal Refactor: Version v0.13.0 removes the dependency on the abandoned ecstatic library and internalizes its functionality. While intended to be a major achievement, this could introduce subtle behavioral changes.
  • Header Changes: As of v0.13.0, the server: http-server-${version} header is no longer sent with every response.

Recommendation:
Given the drop in Node.js support and the significant internal refactoring, this upgrade carries a medium risk. It is crucial to verify that your application is running on a supported Node.js version (6.0 or newer) and to perform thorough regression testing to ensure that the server's behavior, especially regarding static file serving and directory listings, remains consistent after the upgrade.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@socket-security

socket-security Bot commented Jul 9, 2026

Copy link
Copy Markdown

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

@martinSaad

martinSaad commented Jul 9, 2026

Copy link
Copy Markdown

⛔ Snyk checks have failed. 402 issues have been found so far.

Status Scan Engine Critical High Medium Low Total (402)
⛔ Open Source Security 27 240 114 21 402 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@karencapiiro

karencapiiro commented Jul 9, 2026

Copy link
Copy Markdown
Author

Logo
Checkmarx One – Scan Summary & Details – 565cd013-b0d4-44c9-9282-9c2b0e71ea7c

New Issues (412)

Critical: 32 · High: 214 · Medium: 132 · Low: 34

Checkmarx found the following issues in this Pull Request

# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL CVE-2026-0905 Npm-electron-23.1.2
detailsRecommended version: 40.0.0
Description: Insufficient policy enforcement in the Network in Google Chrome prior to 144.0.7559.59 allowed an attacker who obtained a network log file to poten...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: xdBIIJTSFOk0hBrfhOHtOT5rLfbl9ysgbxaou0OPmCY%3D
Vulnerable Package
2 CRITICAL CVE-2026-0906 Npm-electron-23.1.2
detailsRecommended version: 40.0.0
Description: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: w2iuwEKd4RdG81EFBLZPhr68PLicCdRAakWn%2B11dWo8%3D
Vulnerable Package
3 CRITICAL CVE-2026-0907 Npm-electron-23.1.2
detailsRecommended version: 40.0.0
Description: Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Rfi9%2FKEsrWzKLBp91GAwHKUVY0IOHZaVABR85njh9PA%3D
Vulnerable Package
4 CRITICAL CVE-2026-11671 Npm-electron-23.1.2
detailsRecommended version: 40.10.5
Description: Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a craft...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 809TNko1EJLBvzRKmTiG%2BUhLl0cysxPYxxtt%2Bx6%2Fk1g%3D
Vulnerable Package
5 CRITICAL CVE-2026-1525 Npm-undici-5.20.0
detailsRecommended version: 6.24.0
Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: TpflYBIk8490OGA5rSuEskezmSO0ERVFBzAD70JYqQ4%3D
Vulnerable Package
6 CRITICAL CVE-2026-1525 Npm-undici-5.22.1
detailsRecommended version: 6.24.0
Description: Undici versions prior to 6.24.0 and 7.0.x prior to 7.24.0 allow duplicate HTTPContent-Length headers when they are provided in an array with case-v...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ap9N0cZwfXoDD20aKRGSeYeunDg6ZTXeXQWVcU0o1xs%3D
Vulnerable Package
7 CRITICAL CVE-2026-3061 Npm-electron-23.1.2
detailsRecommended version: 41.0.0
Description: Out-of-bounds Read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafte...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: o56T7mPrvTG2MpJ61F%2FxFBOL%2BVU2LZhlPFqFx%2Fk8Bl0%3D
Vulnerable Package
8 CRITICAL CVE-2026-3062 Npm-electron-23.1.2
detailsRecommended version: 41.0.0
Description: Out-of-bounds Read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory acce...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: VYDXWYSruEk467ryMio4PwRtCyS4I9GeJiV1DYKzWGU%3D
Vulnerable Package
9 CRITICAL CVE-2026-33896 Npm-node-forge-0.10.0
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: zA6%2FleD8HqlGm0ZM50jl04NLbMqmb1%2BnkXC5rOyHO2E%3D
Vulnerable Package
10 CRITICAL CVE-2026-33896 Npm-node-forge-0.7.6
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: MiFqY2YBEgzOAK3Uhb%2FE%2F1d9gLCaB1%2FLTQXjVmGIZdc%3D
Vulnerable Package
11 CRITICAL CVE-2026-33896 Npm-node-forge-1.3.1
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: HLwxnjtOdkKq1OrabRHdJhrVjAyfCyrKFD593rJK4jE%3D
Vulnerable Package
12 CRITICAL CVE-2026-33896 Npm-node-forge-0.6.33
detailsRecommended version: 1.4.0
Description: `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: nO2W8QzFSHn5Z6u9uIDdmTC7oIGnsxX8KNNb6R0RBIg%3D
Vulnerable Package
13 CRITICAL CVE-2026-33937 Npm-handlebars-4.7.6
detailsRecommended version: 4.7.9
Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: lSRwz2%2BXy4NbFUTojZw7vmmrClCizlywTJNVTf5euwM%3D
Vulnerable Package
14 CRITICAL CVE-2026-33937 Npm-handlebars-4.7.7
detailsRecommended version: 4.7.9
Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: SzxbxexCAty0UMTOe5v0UZO3aUFiz%2Btp0A2Eop5T59Q%3D
Vulnerable Package
15 CRITICAL CVE-2026-33937 Npm-handlebars-4.5.3
detailsRecommended version: 4.7.9
Description: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: gjQw8sPWBbc0NPFOXhn7GFkbOEnCpPn98wG6Nq8J5lA%3D
Vulnerable Package
16 CRITICAL CVE-2026-34775 Npm-electron-23.1.2
detailsRecommended version: 38.8.6
Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.x prior to 39....
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 5b9mdNbCI0Tu1GcTDrb5kIKmiHHSGhggDlIrqMUAtJU%3D
Vulnerable Package
17 CRITICAL CVE-2026-3545 Npm-electron-23.1.2
detailsRecommended version: 40.10.6
Description: Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox esca...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ijf%2BwuQSj6LRUcwmLCUtW7n%2FOuqiVJY0NXF03PCv6Uo%3D
Vulnerable Package
18 CRITICAL CVE-2026-3916 Npm-electron-23.1.2
detailsRecommended version: 41.0.1
Description: Out-of-bounds Read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a cr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: SZZaK9HceOBOnavwfT1GLcNVLHvGu4hXYNi4c0tVZjw%3D
Vulnerable Package
19 CRITICAL CVE-2026-4800 Npm-lodash-4.17.21
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Jmm9KhWyDHSAA3VWfc6TXq9MtWSbUi0apRquT6Up4Q8%3D
Vulnerable Package
20 CRITICAL CVE-2026-4800 Npm-lodash-4.17.20
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: h0qcESzV3JBKgrjzDLlHZINwES0rZMfJ5c%2Ft%2Fit16IA%3D
Vulnerable Package
21 CRITICAL CVE-2026-4800 Npm-lodash-4.17.11
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ta0NLNESfHfgOOBK1MHYaxTesrZXlfqjUAcqkbT%2FMVw%3D
Vulnerable Package
22 CRITICAL CVE-2026-4800 Npm-lodash-4.17.4
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: kGUuzhq1%2FTkXIt8TUFzWBp5lesLlRtnbmJvnU7pnFhU%3D
Vulnerable Package
23 CRITICAL CVE-2026-4800 Npm-lodash-4.17.15
detailsRecommended version: 4.18.0
Description: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to "options.imports" key na...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: sEuBjmernEmRxc6zPZEC6T36Y3YUYLTcJ6rarNo0ebw%3D
Vulnerable Package
24 CRITICAL CVE-2026-5288 Npm-electron-23.1.2
detailsRecommended version: 41.2.0
Description: Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ARIJGqa4GR2YNvyEFz64MP9gnCAuYEyhafmGsmKZDnE%3D
Vulnerable Package
25 CRITICAL CVE-2026-53486 Npm-decompress-4.2.1
detailsDescription: When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes th...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: YG8NVmIjLXNQC9eIxYjGbdOQv04c94QZEPfMHvRNBUo%3D
Vulnerable Package
26 CRITICAL CVE-2026-59873 Npm-tar-2.2.2
detailsRecommended version: 7.5.19
Description: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: A%2F53rXwDtB6H1IizPyv7jnpN3bvB65AGdcBph%2BovDFA%3D
Vulnerable Package
27 CRITICAL CVE-2026-59873 Npm-tar-2.2.1
detailsRecommended version: 7.5.19
Description: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: eusWk0O4c30zAt%2FdYmEe4INMitU3SzmSIndq2CBwVoQ%3D
Vulnerable Package
28 CRITICAL CVE-2026-9277 Npm-shell-quote-1.7.3
detailsRecommended version: 1.8.4
Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: XONal%2F4V1%2FVAumRm%2Bvu1RvngEjiLa1KwAfq5s7Ve5Sg%3D
Vulnerable Package
29 CRITICAL CVE-2026-9277 Npm-shell-quote-1.8.1
detailsRecommended version: 1.8.4
Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: TyFDp8CtoFJHuAhZMZQgfqJwqBbmFn%2FTho3s89Ygp9s%3D
Vulnerable Package
30 CRITICAL CVE-2026-9277 Npm-shell-quote-1.7.1
detailsRecommended version: 1.8.4
Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: gRWPc6Ut4E7cy68%2B7nvp5gitkg86x%2FTDojOkSMkM%2B%2FU%3D
Vulnerable Package
31 CRITICAL CVE-2026-9277 Npm-shell-quote-1.6.1
detailsRecommended version: 1.8.4
Description: shell-quote `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-esc...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 7Bc3B7U4x28KSu1Z3Nf4v8xkE09PKw4P3jgvkxVTKFQ%3D
Vulnerable Package
32 CRITICAL Cx0a53ef16-dcb9 Npm-react-devtools-shared-0.0.1
detailsDescription: This package was manually inspected by a security researcher and flagged as malicious ### About Classifying malicious packages is an internal proc...

ID: bkVQcS3BfbGqVMPm7rCIJLHEoWERm8sJ35U%2FHpppsN4%3D
Vulnerable Package
33 HIGH CVE-2023-1220 Npm-electron-23.1.2
detailsRecommended version: 24.0.0
Description: Heap-based Buffer Overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to pot...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: qw5Rv1Ypcf%2Br%2B54Ucw6De7sckskbFAMfMIzlAsAtqZ4%3D
Vulnerable Package
34 HIGH CVE-2023-1530 Npm-electron-23.1.2
detailsRecommended version: 24.0.0
Description: Use after free in PDF in Google Chrome versions prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a craf...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: hzQidkR0IatBAUWx1iimsxfm%2BW4qwPtv7dXmdc6sRpk%3D
Vulnerable Package
35 HIGH CVE-2023-1811 Npm-electron-23.1.2
detailsRecommended version: 24.0.0
Description: Use after free in Frames in Google Chrome in versions prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific U...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 8fDH11hq65vBoEy8UCugj6lp37IpMF1aDdor2JyeRnw%3D
Vulnerable Package
36 HIGH CVE-2023-2135 Npm-electron-23.1.2
detailsRecommended version: 24.1.3
Description: Use After Free in DevTools in Google Chrome in versions prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific p...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: uYBGa6dNoCqUVa4%2FieWELBORs34WUxPKnOfX2kza8Rw%3D
Vulnerable Package
37 HIGH CVE-2024-52011 Npm-launch-editor-2.6.0
detailsRecommended version: 2.9.0
Description: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 4XdBFqwIeSHplzgyqM7s5Ia7jj%2FeGilwH5TIxAc%2FEUg%3D
Vulnerable Package
38 HIGH CVE-2025-13630 Npm-electron-23.1.2
detailsRecommended version: 40.0.0
Description: Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: eFPoafRrHWvBi0Yk%2F1nGhtuV%2BAbjHrDdpUDTeJUYVXI%3D
Vulnerable Package
39 HIGH CVE-2025-13631 Npm-electron-23.1.2
detailsRecommended version: 38.8.0
Description: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform Privilege Escala...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Bnd58W4ZZWVaEaQcRIGfoWy%2BWtkvLJ6tUH3z%2BBafQjs%3D
Vulnerable Package
40 HIGH CVE-2025-13633 Npm-electron-23.1.2
detailsRecommended version: 38.8.0
Description: Use After Free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: i6125W7ZLzcjFvm14MV3I%2BZubDQ54sWPxzLi5KJBulg%3D
Vulnerable Package

More results are available on the CxOne platform

Fixed Issues (6)

High: 1 · Medium: 5

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
HIGH CVE-2019-10775 Npm-ecstatic-2.2.2
MEDIUM CVE-2025-13466 Npm-body-parser-1.18.2
MEDIUM CVE-2025-13466 Npm-body-parser-1.19.0
MEDIUM CVE-2025-13466 Npm-body-parser-1.20.1
MEDIUM CVE-2025-13466 Npm-body-parser-1.19.2
MEDIUM CVE-2025-13466 Npm-body-parser-1.20.2

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@karencapiiro @martinSaad @snyk-bot