Affected versions of restify are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL.

Proof of Concept:

Request

https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E

Will be included in response:

<script>alert(73541);</script>

Recommendation

Update to version 4.1.0 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-16018
• restify/node-restify#1018
• GHSA-qw3g-35hc-fcrh
• https://www.npmjs.com/advisories/314