CVE-2026-48049

The CVE-2026-48049 issue affects @hapi/inert (versions 4.0.0–7.1.0). A confinement bypass was caused by a flawed raw string-prefix path check, allowing an unauthenticated remote attacker to read files via traversal (e.g., /..%2fstatic-secret/secret.txt). The vulnerability is mitigated by upgradin...

@iotfactory/poetry (>=0.7.1-alpha.12, <=0.11.3), @mojaloop/als-consent-oracle (>=1.1.0, <=1.1.7) +23 more potentially affected by CVE-2026-48049 via @hapi/inert (>=7.0.0, <=7.1.0)

@hapi/inert NPM version =7.0.0, =0.7.1-alpha.12, =1.1.0, =15.2.0, =17.1.6, =15.2.0-snapshot.0, =0.1.2, =0.1.4, =0.9.0, =15.5.0-iso.0, =17.1.0, =2.60.1, =14.1.0, =0.9.0, =2.0.3, =2.2.2 and more Source cves: CVE-2026-48049 Source advisory: SNYK:JS-HAPIINERT-17337031...

3id-test-helper (>=1.0.0, <=1.0.4), 3nit-utils (>=0.24.0, <=1.0.2) +314 more potentially affected by CVE-2026-48049 via @hapi/inert (>=5.2.0, <=7.1.0)

@hapi/inert NPM version =5.2.0, =1.0.0, =0.24.0, =3.0.0-beta.1, =4.0.0, =0.9.0, =0.1.0, =1.0.1, =0.9.139, =5.0.0-ayFork-1.0.16, =3.0.0, =6.1.0, =0.0.2, =0.11.0, =9.0.0 and more Source cves: CVE-2026-48049 Source advisory: OSV:GHSA-RCVQ-M9J9-6F4G...