Skip to content
Fencer Vulns
high 8.8

CVE-2021-22964 json

DOS and Open Redirect with user input

published 2021-10-12 5 y ago modified 2026-06-17 4 mo ago also GHSA-pgh6-m65r-2rhq , EUVD-2021-2236

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

Patch / fix

  • npm fastify-static 4.4.1
  • fastify fastify-static 4.4.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-22964 updated cvss 5.9

fastify-static: open redirect and DoS via an URL with double slash followed by a domain and with invalid characters

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-ui-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • hackerone.com https://hackerone.com/reports/1361804 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

Affected packages

ecosystem package affected fixed in
npm fastify-static
>=4.2.4, <4.4.1
4.4.1

Affected products

  • n/a https://github.com/fastify/fastify-static

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-601 URL Redirection to Untrusted Site
  • CWE-248 Uncaught Exception

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.