CVE-2021-22964 DOS and Open Redirect with user input

What is CVE-2021-22964?

CVE-2021-22964 is a high-severity vulnerability in https://github.com/fastify/fastify-static, published on 14 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

Weakness: CWE-601, CWE-400

Which versions are affected by CVE-2021-22964?

2 open source packages ship an affected version, including fastify-static. It affects 1 product.

Products include Fastify Fastify-Static.

How do I fix CVE-2021-22964?

Upgrade fastify-static to 4.4.1 or later.

Is CVE-2021-22964 being exploited?

There is no known exploitation of CVE-2021-22964 in the wild and no public exploit code.

Other vulnerabilities in https://github.com/fastify/fastify-static

• CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments High 7.5
• CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal High 7.5
• CVE-2021-22963 URL Redirection to Untrusted Site ('Open Redirect') in fastify-static Medium 6.1
• CVE-2026-6414 @fastify/static vulnerable to route guard bypass via encoded path separators Medium 5.9
• CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pgh6-m65r-2rhq.