@fastify/static vulnerable to route guard bypass via path traversal
Impact
@fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded /deep/*. The getPathnameForSend helper introduced by the fix for GHSA-x428-ghpx-8j92 only guards against the %2F variant; .. and %2E%2E survive the decodeURI + encodeURI round-trip and are then collapsed away by @fastify/send's path.normalize before its own traversal guard runs.
Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with non-leading dot-dot path segments.
Patches
Upgrade to @fastify/static 10.1.1.
Workarounds
Do not use route-based middlewares or guards to protect files served by @fastify/static.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @fastify/static | < 10.1.1 | 10.1.1 |
References
- https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r
- https://nvd.nist.gov/vuln/detail/CVE-2026-15074
- https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify-static
- https://github.com/fastify/fastify-static/releases/tag/v10.1.1
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
@fastify/static- Disclosed
- 24.07.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-83w8-p2f5-377r - CC BY 4.0
Vulnerability history: @fastify/static
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 04.2026 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 3
Disclosures per year
- 2026: 4
-
@fastify/static vulnerable to route guard bypass via path traversal this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.