CVE-2021-22964: High severity fastify fastify-static vulnerability
A redirect vulnerability in the fastify-static module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e.A DOS vulnerability is possible if the URL contains invalid characters curl --path-as-is "http://localhost:3000//^/.."The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22964?
CVE-2021-22964 is classified as a medium severity vulnerability due to its potential for misuse by remote attackers.
How do I fix CVE-2021-22964?
To fix CVE-2021-22964, update the `fastify-static` module to version 4.4.1 or later.
What types of attacks are possible with CVE-2021-22964?
CVE-2021-22964 allows for redirection attacks that can lead to denial of service or malicious site exposure.
Which versions of fastify-static are affected by CVE-2021-22964?
Fastify-static versions greater than or equal to 4.2.4 and less than 4.4.1 are affected by CVE-2021-22964.
What is the nature of the vulnerability in CVE-2021-22964?
CVE-2021-22964 is a redirect vulnerability that can lead to malicious URL redirection in web applications.