@hapi/inert: Static-file confinement bypass via sibling-prefix path
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hapijs | inert | 4.0.0 to before 7.1.1 | 7.1.1 | Patch available | CNA |
| — | @hapi/inert (npm) | 4.0.0 to before 7.1.1 | 7.1.1 | Patch available | GHSA-rcvq-m9j9-6f4g |
- inert Vendorhapijs Affected 4.0.0 to before 7.1.1 Fixed in 7.1.1 Patch available CNA
- @hapi/inert (npm) Vendor— Affected 4.0.0 to before 7.1.1 Fixed in 7.1.1 Patch available GHSA-rcvq-m9j9-6f4g
Remediation
- Fix · CNA inert (hapijs) Fixed in 7.1.1
- Fix · GHSA-rcvq-m9j9-6f4g @hapi/inert (npm) Fixed in 7.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48049
- 2026-10-03 Alias added: GHSA-rcvq-m9j9-6f4g
References
Other 6
- https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g
- https://github.com/hapijs/inert/pull/176
- https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9
- https://github.com/hapijs/inert/releases/tag/v7.1.1
- https://github.com/hapijs/inert/commit/a65e5b271b5c3405af463469959c5e052eb23a62
- https://github.com/hapijs/inert
More hapijs vulnerabilities
- TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
- TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
- TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
- TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
Sources
- CVE-2026-48049 · CVE Program
- CVE-2026-48049 · NVD
- FIRST EPSS
- GHSA-rcvq-m9j9-6f4g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences