Fastify Static
Monthly
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers without requiring any credentials. The plugin failed to canonicalize non-standard path forms - including dot segments, duplicate slashes, percent-encoded dots, and backslashes - before matching the request path against route-based guards, allowing crafted URLs to evade the guard while the underlying send layer resolves and serves the protected file. This is an incomplete fix for a prior vulnerability in the same component; no public exploit identified at time of analysis, though the technique is a textbook path normalization bypass requiring no advanced skills.
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated remote attacker use dot-dot (../) path segments to reach files inside the static root that were meant to be protected by route-scoped middleware. This is a regression bypass of the earlier CVE-2026-6414 fix, which only blocked encoded forward slashes; the underlying send library normalizes dot segments before its own guard runs, defeating route-guard filtering. No public exploit has been identified at time of analysis, and the flaw is fixed in 10.1.1.
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths accessible to the Node.js process when the directory listing feature is explicitly enabled. The flaw resides in dirList.path(), which uses Node.js path.join() without verifying the resolved path remains within the configured static root, making URL sequences like /public/../etc/ sufficient to escape the intended boundary. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.02%), though the attack is automatable against susceptible configurations; disclosure is limited to directory and file names only - file contents are not readable via this path.
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenticated remote attackers via percent-encoded path separators. The plugin decodes %2F in URLs before filesystem path resolution, while Fastify's router evaluates the raw encoded string - guards checking for a path like /protected/ never fire when the request arrives as /protected%2F, yet @fastify/static serves the file anyway. No public exploit is identified at time of analysis and EPSS is 0.01%, but confidentiality impact is rated High when route guards are the sole access control layer.
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain:. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers without requiring any credentials. The plugin failed to canonicalize non-standard path forms - including dot segments, duplicate slashes, percent-encoded dots, and backslashes - before matching the request path against route-based guards, allowing crafted URLs to evade the guard while the underlying send layer resolves and serves the protected file. This is an incomplete fix for a prior vulnerability in the same component; no public exploit identified at time of analysis, though the technique is a textbook path normalization bypass requiring no advanced skills.
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated remote attacker use dot-dot (../) path segments to reach files inside the static root that were meant to be protected by route-scoped middleware. This is a regression bypass of the earlier CVE-2026-6414 fix, which only blocked encoded forward slashes; the underlying send library normalizes dot segments before its own guard runs, defeating route-guard filtering. No public exploit has been identified at time of analysis, and the flaw is fixed in 10.1.1.
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths accessible to the Node.js process when the directory listing feature is explicitly enabled. The flaw resides in dirList.path(), which uses Node.js path.join() without verifying the resolved path remains within the configured static root, making URL sequences like /public/../etc/ sufficient to escape the intended boundary. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.02%), though the attack is automatable against susceptible configurations; disclosure is limited to directory and file names only - file contents are not readable via this path.
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenticated remote attackers via percent-encoded path separators. The plugin decodes %2F in URLs before filesystem path resolution, while Fastify's router evaluates the raw encoded string - guards checking for a path like /protected/ never fire when the request arrives as /protected%2F, yet @fastify/static serves the file anyway. No public exploit is identified at time of analysis and EPSS is 0.01%, but confidentiality impact is rated High when route guards are the sole access control layer.
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain:. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.