Read the docs
TI-2021-05825 Aliases CVE-2021-22964GHSA-pgh6-m65r-2rhq

Uncontrolled resource consumption in https://github.com/fastify/fastify-static

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service, Spoofing
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400 and CWE-601.

Summary

A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

Why it matters now

EPSS 0.01021 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed fastify-static (npm): 4.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/fastify/fastify-staticAffected >= v4.2.4, Fixed v4.4.1—No fix listedCNA
—fastify-static (npm)4.2.4 to before 4.4.14.4.1Patch availableGHSA-pgh6-m65r-2rhq
  • https://github.com/fastify/fastify-static Vendor— Affected Affected >= v4.2.4, Fixed v4.4.1 Fixed in — No fix listed CNA
  • fastify-static (npm) Vendor— Affected 4.2.4 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-pgh6-m65r-2rhq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:*4.2.4 to before 4.4.1Vulnerablefastify
  • cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:* Versions 4.2.4 to before 4.4.1 Vulnerable ·fastify

Remediation

  • Fix · GHSA-pgh6-m65r-2rhq fastify-static (npm) Fixed in 4.4.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Advanced Cluster Management for Kubernetes 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22964
  2. 2026-10-03 Alias added: GHSA-pgh6-m65r-2rhq

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-15143 @fastify/static vulnerable to route guard bypass via non-canonical path segments CVSS 3.1HIGH 7.5
  • TI-2026-12689 @fastify/static vulnerable to route guard bypass via path traversal CVSS 3.1HIGH 7.5
  • TI-2026-05626 @fastify/static vulnerable to path traversal in directory listing CVSS 3.1MEDIUM 5.3
  • TI-2026-06243 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVSS 3.1MEDIUM 5.3
  • TI-2021-05824 Open redirect in https://github.com/fastify/fastify-static CVSS 3.1MEDIUM 6.1
  • TI-2026-05629 @fastify/static vulnerable to route guard bypass via encoded path separators CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences