High

High severity vulnerability that affects gun

Disclosed: 05.06.2019
Updated: 11.10.2026 10:22

Urgent Upgrade

The static file server module included with GUN had a serious vulnerability:

Using curl --path-as-is allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

Fixed

This has been fixed since version 0.2019.416 and higher.

Who Was Effected?

Most NodeJS users who use the default setup, such as:

npm start
node examples/http.js
Heroku 1-click-deploy
Docker
Now

If you have a custom NodeJS code then you are probably safe unless you have something like require('http').createServer(Gun.serve(__dirname)) in it.

If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked.

Credit

It was reported and fixed by JK0N, but I did not understand the --path-as-is condition.

Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	gun	< 0.2019.416	0.2019.416

References

CVSS score -

Weakness (CWE): CWE-22
Platform: npm
Package: gun
Disclosed: 05.06.2019
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-886v-mm6p-4m66 - CC BY 4.0

Vulnerability history: gun

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

This is the only known vulnerability of this package.

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application