Skip to content
OpenAdvisories

Product · hapijs

inert

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-48049

    @hapi/inert: Static-file confinement bypass via sibling-prefix path

    @hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the conf…

    hapijs inert opensearch-dashboards-3 @hapi/inert Wolfi npm