CVE-2024-22207

Summary

CVE-2024-22207: The fastify-swagger-ui plugin for Fastify, used for serving Swagger UI, has a vulnerability. Prior to version 2.1.0, the default configuration of `@fastify/swagger-ui` does not include a `baseDir` setting, causing all files in the plugin's directory to be accessible via HTTP routes served by the module. This issue can lead to potential unauthorized access or data exposure. Users are advised to upgrade to version 2.1.0 or set the `baseDir` option to secure their configurations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.