VDB
EN
MEDIUM 5.3

GHSA-8pvw-jcv7-9cmj

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

빠른 조치

GHSA-8pvw-jcv7-9cmj — @fastify/static: 아래 명령으로 수정 버전으로 올리세요. 

npm install @fastify/static@10.1.2

상세

### Impact

`@fastify/static` evaluates the `allowedPath` callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as `//file`, `/./file`, or `/public/../private/file` bypass `allowedPath` filtering while resolving to the intended file on disk.

Applications that use `allowedPath` as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

### Patches

Upgrade to `@fastify/static` >= 10.1.2.

### Workarounds

None. Upgrade to the patched version.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

npm / @fastify/static
최초 영향 버전: 0 수정 버전: 10.1.2
수정 npm install @fastify/static@10.1.2

참고