Affected of superstatic are vulnerable to path traversal when used on Windows.

Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms (a known example being Node.js v9.9.0).

Recommendation

Update to version 5.0.2 or later.

References

• firebase/superstatic#255
• firebase/superstatic@e396ff6
• https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71
• https://www.npmjs.com/advisories/652