@fastify/static EUVD-2026-23227

The vulnerable application must use @fastify/static version 8.0.0-9.1.0 and must rely on Fastify route-based middleware or route guards registered at a specific path prefix as the primary or sole access control mechanism for files served by the plugin. The bypass requires that the attacker construct a URL containing a percent-encoded path separator (%2F or %2f) at a position where the encoding causes the guard's pattern to not match. AC:H (high attack complexity per CVSS) reflects this specificity: the attacker must know the protected path structure and which files are gated by route guards. Applications where authentication is enforced globally via Fastify hooks (onRequest/preHandler) applied to all routes, or where session/JWT checks happen outside the route-guard layer, are not bypassed by this technique. Non-default configuration is required: serving sensitive files via @fastify/static behind path-prefix guards is the deployment pattern that creates the exposure.

CVSS 5.9 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N characterizes this as network-exploitable without authentication but requiring specific conditions (AC:H), with high confidentiality impact and no integrity or availability consequences. EPSS at 0.01% (1st percentile) places exploitation probability extremely low, consistent with SSVC's Exploitation: none and Automatable: no ratings. The AC:H assessment is well-grounded: the bypass only matters when route-based guards are the sole access control layer - applications using session authentication, JWT checks, or global auth middleware are not meaningfully exposed. CISA KEV absence and SSVC Technical Impact: partial together suggest this is a real but narrow architectural flaw rather than a broadly critical one. The vulnerability should be prioritized in applications where @fastify/static route guards are the primary or only authorization mechanism for sensitive file paths; in such deployments the real-world risk is substantially higher than the 5.9 base score implies. No conflicting signals between data sources.

An attacker targeting a Fastify application that serves sensitive files via @fastify/static with a route guard on /private/ sends a crafted GET request to /private%2Fsecret.txt. Fastify's router evaluates the raw string /private%2Fsecret.txt, which does not match the guard's /private/ pattern, so the middleware is skipped entirely. @fastify/static then decodes %2F to a literal slash, resolves /private/secret.txt on the filesystem, and returns the file contents to the unauthenticated attacker. No public exploit code has been identified at time of analysis, but a proof-of-concept for the analogous @fastify/middie issue is published in GHSA-cxrg-g7r8-w69p.