serve-handler

The foundation of `serve`

by vercel

handler middleware server single-page-applications static

Star on GitHub ForkWebsite npm

JavaScript

618 stars 116 forks 26 contributorsQuiet · 3mo agoSince 2018 6.1.7MIT

Meet the team

See all 26 on GitHub →

leo168 contributions

AndyBitz18 contributions

TooTallNate10 contributions

Bot

dependabot[bot]3 contributions

thasophearak2 contributions

wellingguzman2 contributions

kachkaev1 contribution

andyburke1 contribution

Languages

View on GitHub →

JavaScript88.2%

EJS11.8%

Commit activity

Last 12 weeks · 0 commits

Full graph →

Community health

2 of 6 standards met

Community profile →

✓README✓License○Contributing○Code of Conduct○Issue Template○PR Template

Recent PRs & issues

Quiet · Last activity 3mo ago

See all on GitHub →

This is not an issue but with High Vulnerable on one of dependencyOpenIssue

Any plan on upgrading minimatch to latest to fix the vulnerable library? Serve relies on serve-handler version 6.1.3. https://github.com/vercel/serve/blob/13.0.2/package.json#L46

brendonco · 1w ago

High Vuln: bump path-to-regexp to ^8.4.0OpenIssue

currently uses version 3.3.0 of which is flagged as containing a high vuln by NIST and several scanners (CVE-2026-4926). Affected versions of are >=8.0.0<=8.3.0. should be bumped to version 8.4.0 (according to GitHub Advisory Database and Snyk) to mitigate high vuln. Please fix when possible!

the-last-pixel · 1w ago

fix: preserve query string on automatic redirectsOpenPR

Summary preserve the original query string for serve-handler's automatic redirects limit the behavior change to and redirects add integration coverage for both redirect paths Problem Requests such as currently redirect to , dropping the original query string. The same thing happens for automatic trailing slash redirects. Scope This patch keeps the change narrow on purpose: it preserves the query string only for redirects generated internally by and . It does not change the behavior of user-configured . Testing Fixes #178

WilliamK112 · 2mo ago

Recent fixes

View closed PRs →

chore(release): bump version to 6.1.8MergedPR

tknickman · 3mo ago

fix: serve directory index when path segment contains a dot (e.g. /docs/1.4)MergedPR

Problem I ran into this while using the Docusaurus command (which uses under the hood) to preview a built Docusaurus site. The site has versioned docs at URLs like , where is a directory on disk () — not a file with an extension. returns (non-empty), so treats the path as a file request and runs the early optimization. That call succeeds — because is a real directory. Since is now set, the block is skipped, and never runs to look up inside the directory. With , returns empty, is cleared, and the response is a 404 — even though exists. Concretely:** a build output like this: returns 404 when served with: Fix After the early , if the resolved path turns out to be a directory, clear so runs and can fall back to (or a sibling): Affected configuration Reproduces when all of the following are true: The requested path's final segment contains a dot (e.g. , ) Tests Added fixtures and four new test cases covering the affected scenarios:

Ethan-Arrowood · 3mo ago

Structured data for AI agents

Repository: vercel/serve-handler. Description: The foundation of `serve` Stars: 618, Forks: 116. Primary language: JavaScript. Languages: JavaScript (88.2%), EJS (11.8%). License: MIT. Homepage: https://npmjs.com/serve-handler Topics: handler, middleware, server, single-page-applications, static. Latest release: 6.1.7 (5mo ago). Open PRs: 38, open issues: 48. Last activity: 3mo ago. Community health: 50%. Top contributors: leo, AndyBitz, TooTallNate, dependabot[bot], thasophearak, wellingguzman, kachkaev, andyburke, AxlLind, balupton and others.