CVE-2026-48049

Name of the Vulnerable Software and Affected Versions @hapi/inert versions 4.0.0 through 7.1.0

Description An issue exists in how static files are served when confinement is enforced by the confine option. The confinement check uses a raw string-prefix test to compare the resolved absolute path against the confine directory. This allows an unauthenticated remote attacker to access sibling directories that share the same string prefix as the served directory. For example, if /app/static is the served directory, a sibling directory named /app/static-secret would be incorrectly accepted, allowing the attacker to read files via a request such as /..%2fstatic-secret/secret.txt if the file is readable by the server process.

Recommendations Update @hapi/inert to version 7.1.1. Ensure the directory served via inert has no sibling directory whose name starts with the same characters as the served directory by renaming or moving the sibling directory.