@fastify/static

6 results · Feed

• Medium 5.3
  CVE-2026-90982

  @fastify/static vulnerable to route guard bypass via path case-folding

  @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by…

  @fastify/static @fastify/static
  Sep 17, 2026
• High 7.5
  CVE-2026-18427

  @fastify/static vulnerable to route guard bypass via non-canonical path segments

  @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes befo…

  @fastify/static @fastify/static
  Aug 6, 2026
• High 7.5
  CVE-2026-15074

  @fastify/static vulnerable to route guard bypass via path traversal

  @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the unde…

  @fastify/static @fastify/static @fastify/static npm
  Jul 23, 2026
• Medium 5.3
  CVE-2026-7120

  @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

  @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath res…

  @fastify/static @fastify/static @fastify/static npm
  Jul 23, 2026
• Medium 5.3
  CVE-2026-6410

  @fastify/static vulnerable to path traversal in directory listing

  @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remot…

  @fastify/static @fastify/static @fastify/static npm
  Apr 16, 2026
• Medium 5.9
  CVE-2026-6414

  @fastify/static vulnerable to route guard bypass via encoded path separators

  @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that pr…

  @fastify/static @fastify/static @fastify/static npm
  Apr 16, 2026