Description
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fastify | fastify-swagger-ui | < 2.1.0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Fastify Swagger-UI - Information Disclosure http/cves/2024/CVE-2024-22207.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @fastify/swagger-ui | >= 2.0.0, < 2.1.0 | 2.1.0 | GHSA-62jr-84gf-wmg4 |