EUVD-2026-47871
GHSA-83w8-p2f5-377r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated remote attacker use dot-dot (../) path segments to reach files inside the static root that were meant to be protected by route-scoped middleware. This is a regression bypass of the earlier CVE-2026-6414 fix, which only blocked encoded forward slashes; the underlying send library normalizes dot segments before its own guard runs, defeating route-guard filtering. No public exploit has been identified at time of analysis, and the flaw is fixed in 10.1.1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Fastify Static gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (openjs) · only source for this CVE.
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1.
Blast Radius
ecosystem impact- 11 npm packages depend on @fastify/static (1 direct, 10 indirect)
Ecosystem-wide dependent count for version 10.1.1.
Executive ViewAI
@fastify/static versions up to 10.1.0 contain a path-traversal vulnerability that allows unauthenticated attackers to bypass route-level middleware protections and access restricted files through directory traversal sequences. Organizations using vulnerable versions risk unauthorized exposure of protected files and data within the static root directory. Immediate upgrade to version 10.1.1 is required to eliminate this authentication bypass.
Within 24 hours, identify all applications using @fastify/static versions 10.1.0 or earlier and assess production exposure; begin testing the upgrade to version 10.1.1 in a non-production environment. Within 7 days, complete security testing of version 10.1.1 in staging and coordinate production deployment windows with development teams. Within 30 days, roll out version 10.1.1 across all production systems with monitoring enabled to detect unusual file access patterns during the transition.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Fastify Static
View allA redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers w
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenti
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for a
Authorization bypass in @fastify/static before 10.1.4 lets an unauthenticated remote attacker read files that a route gu
Exploit-DB