CVE-2026-15074: Fastify @fastify/static route guard bypass via path traversal

CVE-2026-15074 · Severity: high · CVSS 7.5 · Published 2026-07-23

A vulnerability in the @fastify/static library, which is used to serve static files in web applications, allows attackers to bypass security rules intended to protect sensitive files. By using specially crafted web addresses containing ".." segments, an attacker can trick the system into serving files that should be restricted or hidden behind login screens. This could lead to the unauthorized exposure of private documents, configuration files, or other sensitive data.

Technologies: Fastify Static, @fastify/static (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-15074 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15074 being exploited in the wild.
How severe is CVE-2026-15074?
High severity, with a CVSS score of 7.5, published 23 July 2026.
Which products and versions are affected?
Fastify Static <= 10.1.0; @fastify/static (npm) <= 10.1.0, SEMVER:introduced=0,fixed=10.1.1.
Is there a fix for CVE-2026-15074?
Yes. @fastify/static (npm): upgrade to 10.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15074 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15074?
Check whether you run Fastify Static or @fastify/static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @fastify/static (npm): upgrade to 10.1.1 or later
    npm install @fastify/static@10.1.1

Technical details

@fastify/static is vulnerable to a route guard bypass via path traversal (CWE-22). The root cause is that the underlying router, 'find-my-way', does not normalize '..' or '%2E%2E' segments when matching routes. Consequently, a request like '/public/../protected/file.txt' may bypass guards intended for the '/protected/' prefix and instead match the static plugin's catch-all handler. While a previous fix addressed '%2F' variants, '..' segments survive the internal URI round-trip and are only normalized by the underlying '@fastify/send' library after the route-level security checks have already been bypassed. This allows unauthenticated remote attackers to access files that should be protected by middleware. The issue is fixed in version 10.1.1.

Affected products

  • Fastify @fastify/static <= 10.1.0

Identifiers

  • CVE-2026-15074
  • GHSA-83w8-p2f5-377r

Timeline

  • 2026-07-22: patched: Version 10.1.1 released
  • 2026-07-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.