Is CVE-2026-6414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6414 being exploited in the wild.

How severe is CVE-2026-6414?

Medium severity, with a CVSS score of 5.9, published 16 April 2026.

Which products and versions are affected?

Fastify Static >= 8.0.0, = 8.0.0, <= 9.1.0, SEMVER:introduced=8.0.0,fixed=9.1.1.

Is there a fix for CVE-2026-6414?

Yes. @fastify/static (npm): upgrade to 9.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6414 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6414?

Check whether you run Fastify Static or @fastify/static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6414: Fastify @fastify/static route guard bypass via encoded path separators

Q: Is there a fix for CVE-2026-6414?

Yes. @fastify/static (npm): upgrade to 9.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-6414 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-6414?

Check whether you run Fastify Static or @fastify/static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6414 · Severity: medium · CVSS 5.9 · Published 2026-04-16

A vulnerability in the Fastify static file plugin allows attackers to bypass security rules intended to protect sensitive files. By using specially formatted web addresses with encoded characters, an attacker can access restricted files that should be blocked by the application's security guards. This could lead to the unauthorized exposure of internal documents or administrative files.

Technologies: Fastify Static, @fastify/static (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-6414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6414 being exploited in the wild.
How severe is CVE-2026-6414?: Medium severity, with a CVSS score of 5.9, published 16 April 2026.
Which products and versions are affected?: Fastify Static >= 8.0.0, <= 9.1.0; @fastify/static (npm) >= 8.0.0, <= 9.1.0, SEMVER:introduced=8.0.0,fixed=9.1.1.
Is there a fix for CVE-2026-6414?: Yes. @fastify/static (npm): upgrade to 9.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6414 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6414?: Check whether you run Fastify Static or @fastify/static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@fastify/static (npm): upgrade to 9.1.1 or later
```
npm install @fastify/static@9.1.1
```

Technical details

The @fastify/static plugin (v8.0.0 to v9.1.0) improperly handles URL-encoded path separators (%2F). While the core Fastify router treats '%2F' as a literal character string for routing purposes, the @fastify/static plugin decodes these characters before resolving the file on the filesystem. This discrepancy allows an attacker to craft a URL like '/admin%2Fsecret.html' which fails to match a security guard defined for '/admin/*', but is ultimately served as '/admin/secret.html' by the plugin. This results in a bypass of route-based middleware or authorization guards. The issue is fixed in version 9.1.1.

Affected products

Fastify @fastify/static >= 8.0.0, <= 9.1.0

Identifiers

CVE-2026-6414
GHSA-x428-ghpx-8j92

Timeline

2026-04-16: disclosed
2026-04-16: advisory
2026-04-16: patched: Fixed in version 9.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.