PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8856 Openjsf CVE debrief

CVE-2015-8856 is a cross-site scripting issue in the Node.js serve-index package before 1.6.3. If an attacker can influence a file or directory name that is rendered in a directory listing, the generated page may include attacker-controlled script or HTML. The CVE record was published on 2017-01-23, while the referenced advisory material dates to 2016-04-20.

Vendor
Openjsf
Product
Serve-Index
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Teams running Node.js applications that expose directory listings with serve-index, especially where untrusted users can create or rename files and directories. Security and platform teams should also care if serve-index is pinned in shared dependencies or used in public-facing static hosting.

Technical summary

NVD classifies the issue as CWE-79 with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network reachability but requiring user interaction. The vulnerable CPE entry covers serve-index versions before 1.6.3. The attack condition described in the source data is a crafted file or directory name that is rendered unsafely in a listing, enabling script or HTML injection when a user views the page.

Defensive priority

Medium. The issue is externally reachable and can impact confidentiality and integrity, but it requires user interaction and is bounded to affected directory-listing deployments.

Recommended defensive actions

  • Upgrade serve-index to version 1.6.3 or later.
  • Inventory applications and services that expose directory listings and confirm whether serve-index is in use.
  • Disable directory listing features where they are not needed.
  • Review any custom rendering or wrapper logic to ensure file and directory names are HTML-escaped before display.
  • Verify dependency locks and transitive dependencies so vulnerable serve-index versions are not reintroduced.

Evidence notes

The NVD record lists the affected range as serve-index before 1.6.3 and maps the weakness to CWE-79. It also provides the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. References in the CVE data include an Openwall mailing-list advisory and a NodeSecurity advisory/patch, which support the version boundary and remediation guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-8856 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-8856

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-8856 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-8856

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.