@fastify/static EUVD-2026-54086

Exploitation requires two conditions to be simultaneously true: the target must run @fastify/static in a version prior to 10.1.3, AND the application must protect a subtree of the static root using a route-based guard (a Fastify route plugin, hook, or middleware that restricts access based on URL prefix). Applications using only the allowedPath option are explicitly not vulnerable per the vendor advisory. The attacker must be able to reach the Fastify HTTP endpoint over the network; no authentication is required (PR:N per CVSS vector) and no user interaction is needed. Exploitation is bounded by the guard mechanism: only route-based guards are bypassed; OS-level file permissions, allowedPath logic, or upstream reverse proxy normalization remain effective barriers. If no route-based guard is configured, the attack surface does not exist.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) accurately reflects the threat: network-reachable, low complexity, no authentication, high confidentiality impact, with no integrity or availability consequence and unchanged scope. The real-world risk is meaningfully conditional: only applications that protect a static subtree using a route-based guard (not the allowedPath option) are exposed - a significant narrowing factor. No CISA KEV listing and no public POC exist at time of analysis, and EPSS data was not provided so exploitation probability cannot be quantified. However, path normalization bypass is an extremely well-documented class of attack requiring no specialized knowledge, which lowers the practical bar substantially. The net assessment is a genuine high priority for affected configurations - route-guard-protected Fastify deployments should patch immediately - but not universally critical, as allowedPath users are explicitly exempt. There is no conflict between CVSS signals and the description; both align on unauthenticated network access with disclosure-only impact.

An attacker identifies a Fastify application serving static files where a route-based guard restricts access to a path such as /private/. By sending a crafted GET request using a non-canonical path form - for example, GET /%2Eprivate/secret.json or GET /public/../private/secret.json with encoded or duplicated segments - the routing layer matches a different, unguarded route while the send library resolves the canonical path and serves the protected file's contents. No authentication or prior access is required, and no public POC exists at time of analysis, though the technique is widely understood.