CVE-2026-6414: Fastify @fastify/static route guard bypass via encoded path separators

Executive brief

A vulnerability in the Fastify static file plugin allows attackers to bypass security rules intended to protect sensitive files. By using specially formatted web addresses with encoded characters, an attacker can access restricted files that should be blocked by the application's security guards. This could lead to the unauthorized exposure of internal documents or administrative files.

Technical details

The @fastify/static plugin (v8.0.0 to v9.1.0) improperly handles URL-encoded path separators (%2F). While the core Fastify router treats '%2F' as a literal character string for routing purposes, the @fastify/static plugin decodes these characters before resolving the file on the filesystem. This discrepancy allows an attacker to craft a URL like '/admin%2Fsecret.html' which fails to match a security guard defined for '/admin/*', but is ultimately served as '/admin/secret.html' by the plugin. This results in a bypass of route-based middleware or authorization guards. The issue is fixed in version 9.1.1.

Affected products

• Fastify @fastify/static >= 8.0.0, <= 9.1.0

Timeline

• 2026-04-16: disclosed
• 2026-04-16: advisory
• 2026-04-16: patched: Fixed in version 9.1.1

References

• https://api.github.com/users/blakeembrey
• https://github.com/blakeembrey
• https://api.github.com/users/blakeembrey/gists%7B/gist_id%7D
• https://api.github.com/users/blakeembrey/repos
• https://avatars.githubusercontent.com/u/1088987?v=4
• https://api.github.com/users/blakeembrey/events%7B/privacy%7D