CVE-2021-22963 URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

What is CVE-2021-22963?

CVE-2021-22963 is a medium-severity vulnerability in https://github.com/fastify/fastify-static, published on 14 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.

Weakness: CWE-601

Which versions are affected by CVE-2021-22963?

2 open source packages ship an affected version, including fastify-static. It affects 1 product.

Products include Fastify Fastify-Static.

How do I fix CVE-2021-22963?

Upgrade fastify-static to 4.2.4 or later.

Is CVE-2021-22963 being exploited?

There is no known exploitation of CVE-2021-22963 in the wild and no public exploit code.

Other vulnerabilities in https://github.com/fastify/fastify-static

• CVE-2021-22964 DOS and Open Redirect with user input High 8.8
• CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments High 7.5
• CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal High 7.5
• CVE-2026-6414 @fastify/static vulnerable to route guard bypass via encoded path separators Medium 5.9
• CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p6vg-p826-qp3v.