send (npm)
Streaming static file server with Range and conditional-GET support
Advisories
5
Latest version
1.2.1
Released Dec 15, 2025
License
MIT
OpenSSF Scorecard
6.3 / 10
How to fix
Upgrading to 0.19.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install send@1.2.1yarn
yarn add send@1.2.1pnpm
pnpm add send@1.2.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-m6fv-jmcg-4jfg send vulnerable to template injection that can lead to XSS |
Low EPSS 0.54% |
< 0.19.0 | 0.19.0 |
| GHSA-m6fv-jmcg-4jfg send vulnerable to template injection that can lead to XSS |
Low EPSS 0.54% |
< 0.19.0 | 0.19.0 |
| GHSA-pgv6-jrvv-75jp Moderate severity vulnerability that affects send Withdrawn |
Medium | < 0.8.4 | 0.8.4 |
| GHSA-jgqf-hwc5-hh37 Root Path Disclosure in send |
Medium EPSS 4.70% |
< 0.11.1 | 0.11.1 |
| GHSA-xwg4-93c6-3h42 Directory Traversal in send |
Low EPSS 4.34% |
< 0.8.4 | 0.8.4 |
Source: git+https://github.com/pillarjs/send.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor