Fastify Fastify-static
4 CVEs affecting Fastify Fastify-static. Latest disclosed: 2026-04-16. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22964 | High | 8.8 | 2021-10-14 | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary web… |
CVE-2021-22963 | Medium | 6.1 | 2021-10-14 | A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // fol… |
CVE-2026-6414 | Medium | 5.9 | 2026-04-16 | @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as l… |
CVE-2026-6410 | Medium | 5.3 | 2026-04-16 | @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves d… |