-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unconditional registration of fastify-static and the wildcard route handler in lib/routes.js. The original code: 1) Registered fastify-static with root=opts.baseDir || __dirname/.. (module directory) 2) Created a /* route that served any file via sendFile(). When baseDir wasn't set, this combination allowed access to all files in the module directory. The patch moved both the static registration and route creation inside an if (opts.baseDir) block, making them conditional. The handler function in the wildcard route is specifically vulnerable as it directly serves files from the uncontrolled root directory when baseDir is missing.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @fastify/swagger-ui | npm | >= 2.0.0, < 2.1.0 | 2.1.0 |
Ongoing coverage of React2Shell