CVE-2021-22963: Medium severity fastify fastify-static vulnerability
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-22963?
CVE-2021-22963 is a redirect vulnerability in the fastify-static module version < 4.2.4.
How does CVE-2021-22963 work?
CVE-2021-22963 allows remote attackers to redirect users to arbitrary websites by using a double slash followed by a domain in the URL.
What is the severity of CVE-2021-22963?
CVE-2021-22963 has a severity rating of 5.3 (medium).
Which software versions are affected by CVE-2021-22963?
Fastify-static module versions less than 4.2.4 are affected by CVE-2021-22963.
How can I fix CVE-2021-22963?
To fix CVE-2021-22963, you should update the fastify-static module to version 4.2.4 or higher.