Most recent entries from all

EUVD-2026-23255

fkie_cve-2021-22963

A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.

GHSA-p6vg-p826-qp3v — URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

Affected: npm: fastify-static

### Impact

A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//google.com/%2e%2e`.

The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

### Patches The issue has been patched in `fastify-static@4.2.4`

### Workarounds If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.

### References

+ Bug founder: drstrnegth + [hackerone Report](https://hackerone.com/reports/1354255)

### For more information If you have any questions or comments about this advisory: * Open an issue in [fastify-static](https://github.com/fastify/fastify-static) * Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)

gsd-2021-22963

RHSA-2022:0735 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes nodejs-json-schema: Prototype pollution vulnerability fastify-static: open redirect via an URL with double slash followed by a domain moby: `docker cp` allows unexpected chmod of host file moby: data directory contains subdirectories with insufficiently restricted permissions, which could lead to directory traversal golang.org/x/crypto: empty plaintext packet causes panic containerd: Unprivileged pod may bind mount any privileged regular file on disk minio: user privilege escalation in AddUser() admin API node-fetch: exposure of sensitive information to an unauthorized actor nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account

WID-SEC-W-2022-0235 — Red Hat Advanced Cluster Management: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Advanced Cluster Management ausnutzen, um seine Privilegien zu erhöhen.