RUSTSEC-2022-0072: Location header incorporates user input, allowing open redirect

What to do

1. See which version you have: cargo tree -i hyper-staticfile (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p hyper-staticfile. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example hyper-staticfile = "0.9.4") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

When hyper-staticfile performs a redirect for a directory request (e.g. a request for /dir that redirects to /dir/), the Location header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed performing a scheme-relative redirect instead.

An attacker could craft a special URL that would appear to be for the correct domain, but immediately redirects to a malicious domain. Such a URL can benefit phishing attacks, for example an innocent looking link in an email.

References

• Package: crates.io/crates/hyper-staticfile
• Advisory: rustsec.org/advisories/RUSTSEC-2022-0072.html
• Web: github.com/stephank/hyper-staticfile/commit/f12cadc6666c6f555d29725f5bc45da2103f24ea

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for hyper-staticfile

• VulnerabilityRUSTSEC-2022-0069 · 2022-11-30Improper validation of Windows paths could lead to directory traversal attack

Full security history of hyper-staticfile