CVE Feed

    Dashboard / CVE / CVE-2021-22963

    CVE-2021-22963

    A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.

    Published:Sep 29, 2021
    Last Modified:Nov 21, 2024
    EPS:Oct 14, 2021
    EPSS Score:0.00172
    CVSS Score:6.1

    Affected Products

    Vendor
    Fastify
    Product
    Fastify-static
    Vendor
    Redhat
    Product
    Acm

    Exploits

    https://hackerone.com/reports/1354255https://hackerone.com/reports/1354255

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2026-18427 (CVSS 7.5) — @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static…
    CVE-2026-15074 (CVSS 7.5) — @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames …
    CVE-2026-7120 (CVSS 5.3) — @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separato…
    CVE-2026-6410 (CVSS 5.3) — @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the li…
    CVE-2026-6414 (CVSS 5.9) — @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem re…
    CVE-2021-22964 (CVSS 8.8) — A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers t…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High