CVE-2015-8859: The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Security readout for executives and security teams

CVE-2015-8859 is an information disclosure issue in the Node.js send package before 0.11.1. The public description says attackers may obtain the application root path, but the available bundle does not describe impact beyond that path disclosure. Exposure is likely limited to Node.js applications that include send before 0.11.1, directly or through another dependency. The bundle does not identify specific products, frameworks, or deployment conditions. Treat this as dependency hygiene unless exposed in a live Node.js service. The known impact is root path disclosure, but source detail is thin, so prioritize confirmation and upgrade over emergency response. Mitigation focus: Upgrade send to 0.11.1 or later where it is present.; Review vendor or maintainer guidance for affected dependency chains.; Rebuild and redeploy applications after dependency updates..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.