WERKZEUG · CVE-2026-102598 · Package
FIX → 3.1.9
Werkzeug's safe_join function, used by send_from_directory, accepts Windows special device names such as NUL: when they carry an empty NTFS alternate data stream marker. On Windows with NTFS, a request for such a path opens successfully but the read hangs indefinitely, which is a denial of service rather than file disclosure.
first public Sep 27, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that use Werkzeug's send_from_directory or safe_join on Windows with NTFS volumes, where the requested path can be attacker-controlled. The sources describe a hang on read rather than access to other files, so Linux deployments and apps that never serve user-chosen paths are unlikely to be affected.
Not affected if linux-only, no-user-supplied-paths
Who cares flask, python, werkzeug, windows
pip show werkzeug and compare it to the affected range below.send_from_directory or safe_join calls in the application code that serve user-supplied paths.Upgrade to 3.1.9
werkzeug (fixed version per the product data; affected below )Werkzeug's safe_join function allows Windows device names as filenames when they have an empty ADS marker on NTFS.
This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact Windows allows special device names with an empty ADS marker, such as NUL:.
send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows and NTFS, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.1.93.1.9This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.