@pkg-nec/http-server supported versions:

Upstream http-server (http-party/http-server) is out of scope for this policy. If you're using the unscoped http-server package, please report to that project instead.

Please report vulnerabilities privately via GitHub's private security advisory form on pkg-nec/http-server. We aim to acknowledge reports within 5 business days.

Public issues are also acceptable for lower-severity findings where you believe a public discussion will not put users at increased risk.