CVE-2021-22964: fastify fastify-static Uncontrolled Resource Consumption
Vulnerability summary
CVE-2021-22964 is a high (CVSS 8.8) Uncontrolled Resource Consumption vulnerability in fastify fastify-static. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 14-10-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H
EPSS trend
Probability
1.02%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
0.00 pp
From 1.02% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Fastify1 product
- fastify-static≥ 4.2.4, < 4.4.1
Npm1 product
- fastify-static≥ 4.2.4, < 4.4.1
2 vendors · 2 products
