Description
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | https://github.com/fastify/fastify-static | Affects < v4.2.4. Fixed in >= v4.2.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fastify-static | < 4.2.4 | 4.2.4 | GHSA-p6vg-p826-qp3v |
Advisories 1
- WID-SEC-2022-0235 Red Hat Advanced Cluster Management: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Oct 8, 2026