@hapi/inert has a static-file confinement bypass via sibling-prefix path
@hapi/inert serves static files from a directory configured with path (in the directory / file handlers) or relativeTo (for h.file()), with confinement enforced by the confine option (default true). Before the patch, the confinement check compared the resolved absolute path against the confine directory using a raw string-prefix test, so a sibling directory whose absolute path begins with the same characters as the confine directory (eg. /app/static-secret next to a …