Executive brief
A vulnerability in the @hapi/inert library, which handles static file serving for hapi.js web applications, could allow unauthorized access to sensitive files. If a server is configured to share a specific folder, an attacker can bypass security restrictions to read files in other folders that happen to have similar names. This could lead to the exposure of private configuration files or internal data if they are stored in adjacent directories on the server.
Technical details
A path traversal vulnerability exists in @hapi/inert versions 4.0.0 through 7.1.0 due to an insecure confinement check. The 'confine' option, which is intended to restrict file access to a specific directory, uses a raw string-prefix comparison on resolved absolute paths. Because the check does not ensure the prefix ends with a path separator, an attacker can use URL-encoded traversal sequences (e.g., /..%2f) to access sibling directories that share a common string prefix (e.g., accessing '/app/static-secret' when only '/app/static' is authorized). This allows unauthenticated remote attackers to read arbitrary files in those sibling directories, provided the server process has read permissions. The issue is resolved in version 7.1.1 by improving the path validation logic.
Affected products
- hapi.js inert >= 4.0.0, < 7.1.1
Timeline
- 2026-05-20: patched: Fix committed and version 7.1.1 released
- 2026-07-17: disclosed: Public advisory and CVE published