EUVD-2026-47871
GHSA-83w8-p2f5-377r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (openjs) · only source for this CVE.
CVSS VectorVendor: openjs
Lifecycle Timeline
3Blast Radius
ecosystem impact- 8 npm packages depend on @fastify/static (1 direct, 7 indirect)
Ecosystem-wide dependent count for version 10.1.1.
DescriptionCVE.org
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1.
AnalysisAI
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated remote attacker use dot-dot (../) path segments to reach files inside the static root that were meant to be protected by route-scoped middleware. This is a regression bypass of the earlier CVE-2026-6414 fix, which only blocked encoded forward slashes; the underlying send library normalizes dot segments before its own guard runs, defeating route-guard filtering. No public exploit has been identified at time of analysis, and the flaw is fixed in 10.1.1.
More in Fastify Static
View allA redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers w
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenti
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today