@hapi/inert has a static-file confinement bypass via sibling-prefix path
Impact
@hapi/inert serves static files from a directory configured with path (in the directory / file handlers) or relativeTo (for h.file()), with confinement enforced by the confine option (default true). Before the patch, the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory whose absolute path begins with the same characters as the confine directory (eg. /app/static-secret next to a served /app/static) was incorrectly accepted as confined. An unauthenticated remote attacker who knows or guesses such a sibling name can read any file inside it via a request like /..%2fstatic-secret/secret.txt, provided the file is readable by the server process. Only applications that happen to have a sibling directory sharing a string prefix with the served directory are exploitable; applications with no such sibling are unaffected.
Patches
Upgrade to 7.1.1.
Workarounds
For users who cannot upgrade immediately: ensure the directory served via inert has no sibling whose name starts with the same characters (for example, rename static-secret/ to secret/, or move it to a different parent directory).
Resources
Pull Request: https://github.com/hapijs/inert/pull/176
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @hapi/inert | >= 4.0.0, < 7.1.1 | 7.1.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
@hapi/inert- Disclosed
- 11.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rcvq-m9j9-6f4g - CC BY 4.0
Vulnerability history: @hapi/inert
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.