@fastify/static CVE-2026-7120

Exploitation requires three concrete conditions: (1) the target application uses @fastify/static version 10.1.1 or earlier; (2) the application configures an allowedPath callback to restrict access to specific files or directories within the static root; and (3) the attacker can reach the Fastify HTTP endpoint over the network. No authentication is required, as confirmed by PR:N in the CVSS vector. What limits the impact is that the bypass does not enable path traversal outside the configured static root - only files already within the root that allowedPath was intended to hide are accessible. Applications that do not use the allowedPath callback at all are not affected. Applications that place no sensitive content within the static root gain no practical exposure even if vulnerable.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the bounded nature of this flaw. The network attack vector and zero-privilege requirement mean any internet-facing or intranet-accessible Fastify application using allowedPath for access control is immediately in scope. However, the scope is unchanged (S:U) and confidentiality impact is Low (C:L) because an attacker cannot escape the static root - only files within it that allowedPath was meant to restrict become accessible. Real-world risk is therefore highly contingent on deployment context: if developers rely on allowedPath as a security boundary to hide sensitive files (e.g., configuration snippets, internal docs, or environment-specific assets) within the static root, this is a meaningful information disclosure risk. If allowedPath is used only for non-security purposes (e.g., cosmetic routing), risk is negligible. No EPSS data was provided in the intelligence feed. No KEV listing exists, and no public exploit code has been identified. SSVC signals point to a narrow technical impact with no confirmed exploitation - this is a real but bounded vulnerability requiring patch prioritization rather than emergency response.

An attacker identifies a Fastify application serving static files where the allowedPath callback denies access to a path such as '/internal/config.html'. The attacker crafts a request to '//internal/config.html' or '/./internal/config.html', which the allowedPath callback does not match against its deny rule because the pattern comparison fails on the non-canonical form. The file resolver normalizes the path and serves the file as if the request were fully legitimate. No authentication or prior reconnaissance beyond knowing (or guessing) the restricted path is required.