Skip to content
OpenAdvisories

Package · npm

@fastify/static

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-15074

    @fastify/static vulnerable to route guard bypass via path traversal

    @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the unde…

    @fastify/static @fastify/static @fastify/static npm