EUVD-2026-23227
GHSA-x428-ghpx-8j92
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exploitable without authentication but AC:H because exploitation requires route-guard-only authorization architecture; C:H for protected file disclosure; no I/A impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 npm packages depend on @fastify/static (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 8.0.0.
DescriptionCVE.org
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.
AnalysisAI
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenticated remote attackers via percent-encoded path separators. The plugin decodes %2F in URLs before filesystem path resolution, while Fastify's router evaluates the raw encoded string - guards checking for a path like /protected/ never fire when the request arrives as /protected%2F, yet @fastify/static serves the file anyway. No public exploit is identified at time of analysis and EPSS is 0.01%, but confidentiality impact is rated High when route guards are the sole access control layer.
Technical ContextAI
CWE-177 (Improper Neutralization of URL Encoding) describes the root cause: a security decision is made on a URL before normalization completes, leaving a gap exploitable through encoding tricks. In @fastify/static, the affected decode/check ordering means percent-encoded path separators (%2F) are resolved by the plugin into literal forward slashes before the filesystem lookup, while Fastify's internal router - which drives middleware and route-guard matching - never decodes those characters and therefore does not recognize the path as matching a protected route pattern. The related advisory GHSA-cxrg-g7r8-w69p for @fastify/middie exposes the same architectural mismatch: middie matches regex patterns against raw req.url, so %61dmin bypasses a /admin guard while Fastify's decoder still resolves the route handler correctly. Both issues stem from Fastify's consistent choice to pass undecoded URLs to middleware matchers while the underlying plugins decode separately. Affected CPE: cpe:2.3:a:@fastify/static:@fastify/static:*:*:*:*:*:*:*:* for versions 8.0.0 through 9.1.0.
RemediationAI
Vendor-released patch: @fastify/static 9.1.1. Upgrade immediately via npm install @fastify/static@9.1.1 or yarn add @fastify/static@9.1.1. The vendor advisory at https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92 explicitly states there are no workarounds for this issue, so upgrading is the only remediation path. Additionally, if the application uses @fastify/middie, upgrade it to 9.1.0 or later per GHSA-cxrg-g7r8-w69p (patch commit d44cd56eb724490babf7b452fdbbdd37ea2effba, PR #245). Until patching is possible, deployers should add a defense-in-depth layer: move authorization checks out of route guards and into Fastify hooks (onRequest or preHandler) that normalize the URL before pattern matching, though this is an architectural change with non-trivial development effort and does not replace the vendor fix.
More in Fastify Static
View allA redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated re
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers w
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for a
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today