CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...

PT-2026-63566

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.1 Description An unauthenticated attacker can bypass route-scoped middleware and guards by using non-leading .. and %2E%2E path segments in request pathnames. This occurs because the find-my-way router do...

CVE-2026-7120: Incorrect Behavior Order: Validate Before Canonicalize

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...

CVE-2026-15074: Improper Limitation of a Pathname to a Restricted Directory

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

PT-2026-63567

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.2 Description An unauthenticated attacker can bypass path-based filtering because the allowedPath callback is evaluated before the normalization of dot segments and duplicate path separators in the pathna...

fastify-static-zero-days

@fastify/static — Multiple Zero-Day Vulnerabilities Package...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +783 more potentially affected by CVE-2026-6410 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =0.0.18, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-6410 Source advisory: OSV:GHSA-PR96-94W5-MX2H...

GHSA-PR96-94W5-MX2H @fastify/static vulnerable to path traversal in directory listing

Impact @fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path to resolve a directory outside the root via path.join without a containment check. A remote...

EUVD-2026-23243

@fastify/static vulnerable to path traversal in directory listing...

@fastify/static vulnerable to path traversal in directory listing

Impact @fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path to resolve a directory outside the root via path.join without a containment check. A remote...

@fastify/static vulnerable to route guard bypass via encoded path separators

Impact @fastify/static v9.1.0 and earlier decodes percent-encoded path separators %2F before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/ do not match /admin%2Fsecret.html, but @fastify/static decodes it to...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +783 more potentially affected by CVE-2026-6414 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =0.0.18, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-6414 Source advisory: OSV:GHSA-X428-GHPX-8J92...

EUVD-2026-23227

@fastify/static vulnerable to route guard bypass via encoded path separators...

GHSA-X428-GHPX-8J92 @fastify/static vulnerable to route guard bypass via encoded path separators

Impact @fastify/static v9.1.0 and earlier decodes percent-encoded path separators %2F before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/ do not match /admin%2Fsecret.html, but @fastify/static decodes it to...

CVE-2026-6414

A flaw was found in @fastify/static. A remote attacker can exploit this vulnerability by sending specially crafted requests that include percent-encoded path separators. This mismatch in how @fastify/static decodes these separators compared to the Fastify router allows the attacker to bypass...

CVE-2026-6410

A flaw was found in @fastify/static. When directory listing is enabled, a remote unauthenticated attacker can exploit a path traversal vulnerability. This occurs because the dirList.path function incorrectly resolves directories outside the configured static root. Successful exploitation allows t...

CVE-2026-6410

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path function resolves directories outside the configured static root using path.join without a containment check. A remote unauthenticated attacker can obtain...

CVE-2026-6410 @fastify/static vulnerable to path traversal in directory listing

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path function resolves directories outside the configured static root using path.join without a containment check. A remote unauthenticated attacker can obtain...

CVE-2026-6410 @fastify/static vulnerable to path traversal in directory listing

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path function resolves directories outside the configured static root using path.join without a containment check. A remote unauthenticated attacker can obtain...

CVE-2026-6410

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path function resolves directories outside the configured static root using path.join without a containment check. A remote unauthenticated attacker can obtain...