AIKIDO-2026-781142
@tinyhttp/send is vulnerable to Path Traversal
59
Medium Risk
This Affects:
@tinyhttp/sendTL;DR
@tinyhttp/send exposes res.sendFile() and res.download(), which stream a file from a caller-supplied path. When the root option is not specified, the path is passed straight to the file system without checking for .. traversal sequences. An application that builds the path from untrusted input can be forced to read arbitrary files outside the intended directory, such as system files or secrets. The fix rejects any path containing .. when root is omitted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted input into res.sendFile() or res.download() without setting the root option.
Background info
@tinyhttp/send is vulnerable to Path Traversal in versions 0.0.3 - 2.2.5.
How to fix this
Upgrade the @tinyhttp/send library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant