Hanacus87

**Name of the Vulnerable Software and Affected Versions** serve-static (affected versions not specified) **Description** On Windows hosts, an encoded backslash (`%5C`) in the request path decodes to ``, which the Windows path resolver treats as a separator. Because the router splits paths only on `/`, a request such as `/admin%5Csecret.txt` is treated as a single segment, bypassing middleware mounted on prefixes like `/admin/*`. The `serve-static` guard allows a lone `` to pass, enabling the file resolver to treat it as a nested file under the root. This allows an unauthenticated attacker to read static files intended to be protected by prefix-mounted middleware, although access remains restricted to the configured root directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.