hapijs inert vulnerabilities

Latest hapijs inert CVEs

Newest publication first

1. CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path

   Published 2026-07-17

   Medium·CVSS 5.3 EPSS 0.59%

   @hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.