← Back to CVE List
Vulnerability Intelligence Report

CVE-2021-22964

A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

No Active Exploit Signals
CVSS Base Score
8.8
HIGH
EPSS Probability:0.99%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-400 ↗Denial of Service (CWE-400)

Affected Products & Versions

Vendor Product Affected Versions
fastify fastify-static all

References & Technical Advisories

No reference links found.

Threat Intelligence Signals

EPSS Score
0.988%

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityHackerOne · Bug Bounty Provider · USA
Reserved2021-01-06T00:00:00
Published2021-10-14T14:50:07
Last Updated2024-08-03T18:58:26

LINK COPIED TO CLIPBOARD