EUVD-2026-47870
GHSA-8pvw-jcv7-9cmj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, zero-auth bypass with only low confidentiality impact bounded to the static root; no integrity or availability consequence.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2Blast Radius
ecosystem impact- 27 npm packages depend on @fastify/static (18 direct, 9 indirect)
Ecosystem-wide dependent count for version 10.1.2.
DescriptionCVE.org
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
AnalysisAI
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.
Technical ContextAI
The @fastify/static plugin (cpe:2.3:a:@fastify/static:@fastify/static:*:*:*:*:*:*:*:*) is the official static file serving plugin for the Fastify Node.js web framework. It exposes an allowedPath callback hook that application developers use to restrict which files within the configured static root may be served. The root cause is CWE-180: validation is performed before canonicalization. Specifically, the plugin passes the raw URL pathname to the allowedPath callback before resolving dot segments (e.g., '/./file', '/../file' relative sequences) and before collapsing duplicate path separators (e.g., '//file'). The file resolution layer normalizes these inputs afterward, creating a window where a crafted non-canonical path can fool the callback's pattern-matching logic. This is a classic 'validate before canonicalize' ordering flaw. Critically, the bypass is scoped to the allowedPath filter only - it does not enable directory traversal outside the configured static root, so files outside the root remain inaccessible.
RemediationAI
The primary fix is to upgrade @fastify/static to version 10.1.2 or later, which patches the ordering flaw by normalizing dot segments and duplicate path separators before invoking the allowedPath callback. The advisory is at https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj. For applications that cannot immediately upgrade, a compensating control is to implement path normalization within the allowedPath callback itself - callers can normalize the incoming path argument using Node.js's path.posix.normalize() or the URL API before applying any deny logic. A trade-off is that this requires application-layer changes and must be applied consistently across all allowedPath usages to avoid gaps. Additionally, operators should audit whether any files within the static root that are restricted via allowedPath are genuinely sensitive; if so, they should be moved outside the static root entirely as defense in depth, since static root membership is the only remaining effective boundary until patched.
More in Fastify Static
View allA redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated re
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers w
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenti
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today