| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| fastify-static | < 10.1.2 | 10.1.2 |
| @fastify/static | < 10.1.2 | 10.1.2 |
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.
Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.
Upgrade to @fastify/static >= 10.1.2.
None. Upgrade to the patched version.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン