CVE-2026-48049
1 advisory.
npm/@hapi/inert CVE-2026-48049: medium 5.3
@hapi/inert has a static-file confinement bypass via sibling-prefix path
Action: Upgrade @hapi/inert to 7.1.1 or later.
npm i @hapi/inert@7.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 7.1.1 | - |
Fixed versions
| 7.1.1 |
Sources
- osv: GHSA-rcvq-m9j9-6f4g
- https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g
- https://github.com/hapijs/inert/pull/176
- https://github.com/hapijs/inert/commit/a65e5b271b5c3405af463469959c5e052eb23a62
- https://github.com/hapijs/inert
CVE-2026-48049 · published · modified · JSON