@cognidesk/integration-ticketing-servicenow (>=0.0.4, <=0.0.6), @darthcav/ts-http-server (0.9.1) +11 more potentially affected by CVE-2026-7120 via @fastify/static (>=10.1.0, <=10.1.1)

@fastify/static NPM version =10.1.0, =0.0.4, =3.1.17, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =9.0.0-canary.19, =9.0.2 Source cves: CVE-2026-7120 Source advisory: OSV:GHSA-8PVW-JCV7-9CMJ...

@cognidesk/integration-ticketing-servicenow (>=0.0.4, <=0.0.6), @darthcav/ts-http-server (0.9.1) +11 more potentially affected by CVE-2026-7120 via @fastify/static (>=10.1.0, <=10.1.1)

@fastify/static NPM version =10.1.0, =0.0.4, =3.1.17, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =9.0.0-canary.19, =9.0.2 Source cves: CVE-2026-7120 Source advisory: SNYK:JS-FASTIFYSTATIC-18233800...

CVE-2026-7120

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...