Executive brief
A vulnerability in the @fastify/static library, which is used to serve static files in web applications, allows attackers to bypass security rules intended to protect sensitive files. By using specially crafted web addresses containing ".." segments, an attacker can trick the system into serving files that should be restricted or hidden behind login screens. This could lead to the unauthorized exposure of private documents, configuration files, or other sensitive data.
Technical details
@fastify/static is vulnerable to a route guard bypass via path traversal (CWE-22). The root cause is that the underlying router, 'find-my-way', does not normalize '..' or '%2E%2E' segments when matching routes. Consequently, a request like '/public/../protected/file.txt' may bypass guards intended for the '/protected/' prefix and instead match the static plugin's catch-all handler. While a previous fix addressed '%2F' variants, '..' segments survive the internal URI round-trip and are only normalized by the underlying '@fastify/send' library after the route-level security checks have already been bypassed. This allows unauthenticated remote attackers to access files that should be protected by middleware. The issue is fixed in version 10.1.1.
Affected products
- Fastify @fastify/static <= 10.1.0
Timeline
- 2026-07-22: patched: Version 10.1.1 released
- 2026-07-24: advisory: GitHub Advisory published