CVE-2026-6414

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators %2F before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. F...

CVE-2026-6414

creationtimestamp| type| source ---|---|--- 2026-04-16 13:15:27+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjmik2cvw22a 2026-04-16 13:36:32+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjmjpo4gfc2n 2026-04-16 14:58:59+00:00| seen|...