Fastify Fastify-static — known CVE vulnerabilities

Every CVE whose affected-product data names Fastify Fastify-static, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2021-22964 — CVSS 8.8 (high): A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox…
• CVE-2021-22963 — CVSS 6.1 (medium): A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a…
• CVE-2026-6414 — CVSS 5.9 (medium): @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's…
• CVE-2026-6410 — CVSS 5.3 (medium): @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path()…