EUVD-2026-81383Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request with trivial case-alteration (AV:N/AC:L/PR:N/UI:N); impact limited to reading one guard-protected file so C:L, I:N, A:N, no scope change.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
5DescriptionCVE.org
@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler, yet the filesystem resolves it to the same protected file. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization. As a workaround, serve static files from a case-sensitive filesystem, or ensure route guards and allowedPath rules account for every letter-case variant of the protected paths.
AnalysisAI
Authorization bypass in @fastify/static before 10.1.4 lets an unauthenticated remote attacker read files that a route guard or allowedPath rule was meant to protect, but only when the server runs on a case-insensitive filesystem such as Windows or a default macOS APFS volume. The plugin's route matcher is case-sensitive while the underlying filesystem is not, so requesting a protected segment with altered letter case (for example '/Admin/secret' instead of '/admin/secret') misses the guard and still resolves to the same on-disk file; CVSS 3.1 rates this 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting a confidentiality-only impact limited to files inside the configured static root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions to all hold: (1) the @fastify/static plugin at a version before 10.1.4; (2) the server runs on a case-insensitive filesystem - specifically Windows, or the default (case-insensitive) macOS APFS volume - the flaw does NOT affect case-sensitive Linux filesystems; and (3) the application relies on a route guard or an allowedPath restriction to protect specific files under the static root. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity confidentiality issue, correctly rated 5.3 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 10.1.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allShare
External POC / Exploit Code
Leaving vuln.today