{"id":"CVE-2021-22964","aliases":["EUVD-2021-2236","GHSA-pgh6-m65r-2rhq"],"status":"published","title":"DOS and Open Redirect with user input","description":"A redirect vulnerability in the `fastify-static` module version \u003e= 4.2.4 and \u003c 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is \"http://localhost:3000//^/..\"`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01021,"percentile":0.63705,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-400","CWE-601"],"published":"2021-10-12T16:04:17Z","modified":"2026-10-24T10:30:55Z","fixes":[{"ecosystem":"npm","package":"fastify-static","fixed_in":["4.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fastify-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.4"},{"fixed":"4.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"fastify-static","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.4"},{"fixed":"4.4.1"}]}]}],"products":[{"vendor":"fastify","product":"fastify-static"}],"references":[{"url":"https://hackerone.com/reports/1361804","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/fastify/fastify-static/security/advisories/GHSA-pgh6-m65r-2rhq","tags":["web"]},{"url":"https://github.com/fastify/fastify-static/commit/c31f17d107cb19a0e96733c80a9abf16c56166d4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22964","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pgh6-m65r-2rhq"},{"url":"https://github.com/fastify/fastify-static","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-22964","description":"A redirect vulnerability in the `fastify-static` module version \u003e= 4.2.4 and \u003c 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is \"http://localhost:3000//^/..\"`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.","status":"published","published":"2021-10-14T14:50:07Z","modified":"2024-08-03T18:58:26.128Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-2236","description":"A redirect vulnerability in the `fastify-static` module version \u003e= 4.2.4 and \u003c 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is \"http://localhost:3000//^/..\"`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.","status":"published","published":"2021-10-14T14:50:07Z","modified":"2024-08-03T18:58:26Z","updated_at":"2026-11-03T03:25:00.591933Z"}],"ghsa":[{"id":"GHSA-pgh6-m65r-2rhq","title":"DOS and Open Redirect with user input","description":"### Impact\n\nA redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.\n\nA DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is \"http://localhost:3000//^/..\"`\n\nThe issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.\n\n### Patches\nThe issue has been patched in `fastify-static@4.4.1`\n\n### Workarounds\nIf updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.\n\n### References\n\n+ Bug founder: drstrnegth\n+ [hackerone Report](https://hackerone.com/reports/1361804)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)\n* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)\n","status":"published","published":"2021-10-12T16:04:17Z","modified":"2023-02-01T05:06:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-248","CWE-601"],"updated_at":"2026-11-02T14:36:38.281533Z"}],"nvd":[{"id":"CVE-2021-22964","description":"A redirect vulnerability in the `fastify-static` module version \u003e= 4.2.4 and \u003c 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is \"http://localhost:3000//^/..\"`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.","status":"published","published":"2021-10-14T15:15:08.933Z","modified":"2026-06-17T03:38:07.18Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-601"],"updated_at":"2026-11-02T14:06:59.689345Z"}],"osv":[{"id":"CVE-2021-22964","description":"A redirect vulnerability in the `fastify-static` module version \u003e= 4.2.4 and \u003c 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is \"http://localhost:3000//^/..\"`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.","status":"published","published":"2021-10-14T15:15:08.933Z","modified":"2026-10-24T10:30:55.949588904Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-pgh6-m65r-2rhq","title":"DOS and Open Redirect with user input","description":"### Impact\n\nA redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.\n\nA DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is \"http://localhost:3000//^/..\"`\n\nThe issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.\n\n### Patches\nThe issue has been patched in `fastify-static@4.4.1`\n\n### Workarounds\nIf updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.\n\n### References\n\n+ Bug founder: drstrnegth\n+ [hackerone Report](https://hackerone.com/reports/1361804)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)\n* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)\n","status":"published","published":"2021-10-12T16:04:17Z","modified":"2023-11-08T04:05:02.248197Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-248","CWE-601"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}