What is the CVSS score of EUVD-2026-54086?

EUVD-2026-54086 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of @fastify/static are affected by EUVD-2026-54086?

@fastify/static before version 10.1.3 contains a route guard bypass that exposes protected static files to unauthenticated attackers without requiring credentials.. A patch is available.

How to fix or mitigate EUVD-2026-54086?

Within 24 hours, conduct a comprehensive inventory of all applications using @fastify/static and document their current versions; simultaneously implement temporary compensating controls such as WAF rules or reverse proxy authentication to require authentication for static file endpoints. Within 7 days, develop and test a path canonicalization middleware that sanitizes all file path inputs before route matching, or evaluate alternative static file serving libraries; prioritize applications that serve sensitive content. Within 30 days, deploy the compensating control across all affected applications, audit access logs for evidence of exploitation attempts, conduct a security review of all previously served static files to identify any unauthorized access, and prepare a patched version deployment plan for when vendor releases a fix.

@fastify/static EUVD-2026-54086

| CVE-2026-18427 HIGH

Path Traversal (CWE-22)

2026-08-06 openjs

Path Traversal Canonical Fastify Static

7.5

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable with no authentication required; impact is file disclosure only (C:H, I:N, A:N); scope unchanged as no system boundary is crossed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 06, 2026 - 16:17 EUVD

Analysis Generated

Aug 06, 2026 - 16:10 vuln.today

CVE Published

Aug 06, 2026 - 14:52 cve.org

HIGH 7.5

DescriptionCVE.org

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.

AnalysisAI

Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers without requiring any credentials. The plugin failed to canonicalize non-standard path forms - including dot segments, duplicate slashes, percent-encoded dots, and backslashes - before matching the request path against route-based guards, allowing crafted URLs to evade the guard while the underlying send layer resolves and serves the protected file. This is an incomplete fix for a prior vulnerability in the same component; no public exploit identified at time of analysis, though the technique is a textbook path normalization bypass requiring no advanced skills.

Technical ContextAI

The vulnerability is rooted in CWE-22 (Path Traversal) and specifically in a path canonicalization gap between two processing layers: the Fastify route-matching layer and the send file-serving library. @fastify/static is the official static file plugin for the Fastify Node.js web framework; it delegates actual file serving to the send library. The previous incomplete fix rejected parent-directory segments (../) but did not normalize dot segments (.), duplicate slashes (//), percent-encoded dots (%2E), or Windows-style backslashes before route matching. Because the HTTP routing layer and the filesystem resolver handle these non-canonical forms differently, a crafted URL can appear as a distinct, unguarded path to the route matcher while resolving identically to the protected file on disk. The CPE (cpe:2.3:a:@fastify/static:@fastify/static:*:*:*:*:*:*:*:*) covers all versions prior to the fix. Version 10.1.3 addresses this by applying full pathname canonicalization - including explicit backslash rejection - before both routing and send delegation.

RemediationAI

Upgrade @fastify/static to version 10.1.3 or later, which canonicalizes request pathnames - including backslash rejection - before both route matching and file serving, closing the guard bypass entirely. The vendor advisory at https://github.com/fastify/fastify-static/security/advisories/GHSA-423g-23ch-w7c6 confirms this as the authoritative fix. If immediate patching is not feasible, migrate route-based guards to the allowedPath option, which the vendor explicitly identifies as not affected by this vulnerability; note that allowedPath operates on resolved file paths rather than URL routes and may require application logic adjustments to replicate the same access policy. As an additional compensating control, configure an ingress reverse proxy (nginx, Caddy) to normalize request paths before forwarding to Fastify, or deploy a WAF rule that rejects requests containing percent-encoded dots (%2E), double slashes, or backslashes - both approaches have low side-effect risk for most applications but add operational complexity and should not replace patching.