CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path
An unauthenticated attacker can read files outside the intended directory by exploiting a flawed path confinement check in the hapi.js static file handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48049?
CVE-2026-48049 is a medium-severity path traversal vulnerability in hapijs inert, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-48049?
2 open source packages ship an affected version, including @hapi/inert.
| Package | Affected | Fixed in |
|---|---|---|
@hapi/inert npm | From 4.0.0 | 7.1.1 |
@hapi/inert npm | From 4.0.0 | 7.1.1 |
How do I fix CVE-2026-48049?
Upgrade @hapi/inert to 7.1.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-48049 being exploited?
There is no known exploitation of CVE-2026-48049 in the wild and no public exploit code.
Sources
Also known as GHSA-rcvq-m9j9-6f4g, MINI-29r5-prr9-3788, MINI-36rg-3329-wrph, MINI-7w8j-p27v-7m5v, MINI-8j8g-rr3w-fwqr, MINI-chwf-5g5j-hxp7 and 8 more.