GHSA-89w7-5q45-r53wHighCVSS 7.5

lite-server vulnerable to Denial of Service

Published
December 20, 2022
Last Modified
April 16, 2025

🔗 CVE IDs covered (1)

CVE-2022-25940 →

📋 Description

All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.

🎯 Affected products2

  • npm/lite-server:<= 2.6.1
  • maven/org.webjars.npm:lite-server:<= 2.2.0

🔗 References (5)