hapi inert vulnerabilities

Latest hapi inert CVEs

Newest publication first

1. CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path

   Published 2026-07-17

   Medium·CVSS 5.3 EPSS 0.59%

   @hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the c...

2. CVE-2014-10068 Hidden Directories Always Served in inert

   Published 2018-05-29

   High·CVSS 7.5 EPSS 1.9%

   The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when showHidden is false.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.