CVE-2021-22963: URL Redirection to Untrusted Site ('Open Redirect')

October 5, 2021 (updated October 21, 2021)

A redirect vulnerability in the fastify-static module allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e. The issue shows up on all the fastify-static applications that set redirect: true option. By default, it is false.

References

github.com/advisories/GHSA-p6vg-p826-qp3v
github.com/fastify/fastify-static/security/advisories/GHSA-p6vg-p826-qp3v
hackerone.com/reports/1354255
nvd.nist.gov/vuln/detail/CVE-2021-22963

Code Behaviors & Features

Detect and mitigate CVE-2021-22963 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →