Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered.

Recommendation

Upgrade to version 10.0.2 or later.

References

• https://hackerone.com/reports/358641
• https://www.npmjs.com/advisories/971
• vercel/serve-handler@65b4d41
• https://hackerone.com/reports/398285