CVE-2025-66221

Werkzeug CVE-2025-66221 affects the safe_join path handling in Werkzeug prior to 3.1.4 on Windows. If a request ends with a Windows device name (e.g., CON, AUX), the file is opened but reading can hang indefinitely when using send_from_directory under a directory. The issue has been patched in 3....