Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

CVE-2021-22963 — fastify-static

MEDIUM

CVE-2021-22963 is a medium-severity (CVSS 6.1) Open Redirect vulnerability in fastify-static. 1 public exploit reference exists, so weaponization risk is real. A fix is available for fastify-static — see the affected versions and patch details below.

URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

Also known asGHSA-p6vg-p826-qp3v
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
1 known
Exploitation data as of Oct 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs66th percentile — riskier than 66% of all scored CVEsHighest risk
0.00%0.56%1.11%1.67%0.2%1.2%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2021-22963 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,386 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.

fastify-staticnpm
82Kdownloads / week

Description

Impact

A redirect vulnerability in the fastify-static module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.

The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.

Patches

The issue has been patched in [email protected]

Workarounds

If updating is not an option, you can sanitize the input URLs using the rewriteUrl server option.

References

For more information

If you have any questions or comments about this advisory:

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmfastify-staticall versions4.2.4npm install fastify-static@4.2.4

Affected Products

1 product · 1 configurations
Application
fastify-staticfastify
< 4.2.4
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

A redirect vulnerability in the fastify-static module version < 4.2.4 al…

hackerone.comNVDOct 2021

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fastify-static, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update fastify-static to 4.2.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-22963 is resolved across your whole dependency graph.

  3. Workarounds

    Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.

Frequently Asked Questions

### Impact A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//google.com/%2e%2e`. The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`. ### Patches The issue has been patched in `[email protected]` ### Workarounds If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.
O3 Security · Impact-Aware SCA

Is CVE-2021-22963 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2021-22963: fastify-static — Fixed in 4.2.4