Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e. A DOS vulnerability is possible if the URL contains invalid characters curl --path-as-is "http://localhost:3000//^/.." The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false. Patches The issue has been patched in fastify-static@4.4.1 Workarounds If updating is not an option, you can sanitize the input URLs using the rewriteUrl server option. References + Bug founder: drstrnegth + hackerone Report For more information If you have any questions or comments about this advisory: Open an issue in fastify-static Contact the security team
Recommended action: Upgrade to 4.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e. The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false. Patches The issue has been patched in fastify-static@4.2.4 Workarounds If updating is not an option, you can sanitize the input URLs using the rewriteUrl server option. References + Bug founder: drstrnegth + hackerone Report For more information If you have any questions or comments about this advisory: Open an issue in fastify-static Contact the security team
Recommended action: Upgrade to 4.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.