StackPrism

npm package

send vulnerabilities by version

The latest release, 1.2.1 (Dec 15, 2025), has no known vulnerabilities. 7% of last week’s 153.5M downloads went to versions with known vulnerabilities. OSV.dev lists 3 advisories for send; the newest was published on Sep 10, 2024.

npm (opens in a new tab) describes it as “Better streaming static file server with Range and conditional-GET support”

Latest release
1.2.1
Dec 15, 2025, no known vulnerabilities
Downloads last week
153.5M
All versions, from npm
Advisories on OSV.dev
3
Newest Sep 10, 2024
Licence
MIT
OpenSSF Scorecard
6.3/10
pillarjs/send (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
1.2.1latestDec 15, 2025No known vulnerabilities69M
0.19.2Dec 15, 2025No known vulnerabilities46.8M
0.19.0Sep 10, 2024No known vulnerabilities13.4M
1.2.0Mar 27, 2025No known vulnerabilities11.6M
0.18.0Mar 24, 20221 known vulnerability, worst rated low6.3M
0.17.1May 11, 20191 known vulnerability, worst rated low2.5M
0.19.1Oct 9, 2024No known vulnerabilities1.3M
0.16.2Feb 7, 20181 known vulnerability, worst rated low1M

Who is still on a vulnerable send

7% of last week’s 153.5M send downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. send doesn’t publish support dates we can check.

LineNewest releaseReleased
11.2.1Dec 15, 2025
0.190.19.2Dec 15, 2025
0.180.18.0Mar 24, 2022
0.170.17.2Dec 12, 2021
0.160.16.2Feb 7, 2018
0.150.15.6Sep 22, 2017

Newest advisories

The 3 most recently published, with the versions each one affects.

  1. LowCVE-2024-43799 on OSV.dev (opens in a new tab)GHSA-m6fv-jmcg-4jfg

    send vulnerable to template injection that can lead to XSS

    Affects < 0.19.0. Published Sep 10, 2024.

  2. WarningCVE-2015-8859 on OSV.dev (opens in a new tab)GHSA-jgqf-hwc5-hh37

    Root Path Disclosure in send

    Affects < 0.11.1. Published Oct 24, 2017.

  3. LowCVE-2014-6394 on OSV.dev (opens in a new tab)GHSA-xwg4-93c6-3h42

    Directory Traversal in send

    Affects < 0.8.4. Published Oct 24, 2017.

Which send do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for send, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.