@tus/server
Tus resumable upload protocol in Node.js
88%
Total Score
healthy
Healthy release with active organization-backed maintenance; six of seven workflow actions are unpinned.
Health Score Breakdown
No repository security policy was found, leaving vulnerability-reporting expectations less transparent for adopters.
All three workflows were analyzed with no audit findings or untrusted checkouts, and two use read-only permissions. However, 6 of 7 action references are unpinned and one workflow has top-level write permissions, creating a moderate reproducibility and token-scope hygiene concern.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-397638 @tus/server is vulnerable to Path Traversal in versions 1.0.0 - 2.4.2. | 1.0.0 - 2.4.2 | Critical |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 srvx Version ~0.11.15 | — | — |
debug Version ^4.3.4 | — | — |
@tus/utils Version ^0.7.1 | — | — |
lodash.throttle Version ^4.1.1 | — | — |
set-cookie-parser Version ^2.7.1 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 3 years ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.