1 matches found
GHSA-83W8-P2F5-377R @fastify/static vulnerable to route guard bypass via path traversal
Impact @fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded...
7.5CVSS5.9AI score0.00448EPSS
SaveExploits0References6
20