https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:53:27.370246+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-339091 EUVD-2026-339091 2026-10-06T16:53:27.424426+00:00 EUVD-2026-339091 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48049 fkie_cve-2026-48049 2026-10-06T16:53:27.424482+00:00

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.

 https://cve.radiocsirt.org/vuln/ghsa-rcvq-m9j9-6f4g GHSA-rcvq-m9j9-6f4g — @hapi/inert has a static-file confinement bypass via sibling-prefix path 2026-10-06T16:53:27.424537+00:00

Affected: npm: @hapi/inert

### Impact `@hapi/inert` serves static files from a directory configured with `path` (in the `directory` / `file` handlers) or `relativeTo` (for `h.file()`), with confinement enforced by the `confine` option (default `true`). Before the patch, the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory whose absolute path begins with the same characters as the confine directory (eg. `/app/static-secret` next to a served `/app/static`) was incorrectly accepted as confined. An unauthenticated remote attacker who knows or guesses such a sibling name can read any file inside it via a request like `/..%2fstatic-secret/secret.txt`, provided the file is readable by the server process. Only applications that happen to have a sibling directory sharing a string prefix with the served directory are exploitable; applications with no such sibling are unaffected.

### Patches Upgrade to 7.1.1.

### Workarounds For users who cannot upgrade immediately: ensure the directory served via inert has no sibling whose name starts with the same characters (for example, rename `static-secret/` to `secret/`, or move it to a different parent directory).

### Resources Pull Request: https://github.com/hapijs/inert/pull/176