Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
vercel/serve-handler
main @ ead85eb
3
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Path Traversal: 2 prior fixes. Scrutinize any change in this area.
src/index.js: most-fixed (3 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: A missing containment check allowed serving files outside the configured root, directly exposing arbitrary files. This is the most severe historical issue and indicates a critical gap in path validation before file serving.
Path Traversal: Rewrite patterns were matched against the raw request path without resolution, enabling traversal sequences to bypass protections and reach protected files. This shows that path resolution must occur before any matching logic.
Open Redirect: The redirect mechanism could be abused to send users to external sites when cleanUrls was enabled, due to improper path normalization. This highlights the need to validate redirect targets are internal.