# CVE-2026-6414: Fastify @fastify/static route guard bypass via encoded path separators

Source: https://junglewise.ai/threats/cve-2026-6414-fastify-fastify-static-route-guard-bypass-via-encoded-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-6414 · Severity: medium · CVSS 5.9 · Published 2026-04-16

A vulnerability in the Fastify static file plugin allows attackers to bypass security rules intended to protect sensitive files. By using specially formatted web addresses with encoded characters, an attacker can access restricted files that should be blocked by the application's security guards. This could lead to the unauthorized exposure of internal documents or administrative files.

Technologies: [Fastify Static](https://junglewise.ai/threats/technologies/static), [@fastify/static (npm)](https://junglewise.ai/threats/technologies/fastify-static). Vendors: [Fastify](https://junglewise.ai/threats/vendors/fastify), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-6414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6414 being exploited in the wild.

**How severe is CVE-2026-6414?** Medium severity, with a CVSS score of 5.9, published 16 April 2026.

**Which products and versions are affected?** Fastify Static >= 8.0.0, <= 9.1.0; @fastify/static (npm) >= 8.0.0, <= 9.1.0, SEMVER:introduced=8.0.0,fixed=9.1.1.

**Is there a fix for CVE-2026-6414?** Yes. @fastify/static (npm): upgrade to 9.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6414 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6414?** Check whether you run Fastify Static or @fastify/static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @fastify/static (npm): upgrade to 9.1.1 or later

  ```sh
  npm install @fastify/static@9.1.1
  ```


## Technical details

The @fastify/static plugin (v8.0.0 to v9.1.0) improperly handles URL-encoded path separators (%2F). While the core Fastify router treats '%2F' as a literal character string for routing purposes, the @fastify/static plugin decodes these characters before resolving the file on the filesystem. This discrepancy allows an attacker to craft a URL like '/admin%2Fsecret.html' which fails to match a security guard defined for '/admin/*', but is ultimately served as '/admin/secret.html' by the plugin. This results in a bypass of route-based middleware or authorization guards. The issue is fixed in version 9.1.1.

## Affected products

- Fastify @fastify/static >= 8.0.0, <= 9.1.0

## Identifiers

- CVE-2026-6414
- GHSA-x428-ghpx-8j92

## Timeline

- 2026-04-16: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched: Fixed in version 9.1.1

## References

- [https://api.github.com/users/blakeembrey](https://api.github.com/users/blakeembrey)
- [https://github.com/blakeembrey](https://github.com/blakeembrey)
- [https://api.github.com/users/blakeembrey/gists%7B/gist_id%7D](https://api.github.com/users/blakeembrey/gists%7B/gist_id%7D)
- [https://api.github.com/users/blakeembrey/repos](https://api.github.com/users/blakeembrey/repos)
- [https://avatars.githubusercontent.com/u/1088987?v=4](https://avatars.githubusercontent.com/u/1088987?v=4)
- [https://api.github.com/users/blakeembrey/events%7B/privacy%7D](https://api.github.com/users/blakeembrey/events%7B/privacy%7D)

## Related threats

- [Fastify @fastify/static authorization bypass via non-canonical paths](https://junglewise.ai/threats/cve-2026-7120-fastify-fastify-static-authorization-bypass-via-non-canonical)
- [Fastify @fastify/static route guard bypass via path traversal](https://junglewise.ai/threats/cve-2026-15074-fastify-fastify-static-route-guard-bypass-via-path-traversal)
- [Fastify @fastify/static path traversal in directory listing](https://junglewise.ai/threats/cve-2026-6410-fastify-fastify-static-path-traversal-in-directory-listing)
- [fastify-static open redirect and DOS with user input](https://junglewise.ai/threats/cve-2021-22964-fastify-static-open-redirect-and-dos-with-user-input)
- [Fastify fastify-static open redirect](https://junglewise.ai/threats/cve-2021-22963-fastify-fastify-static-open-redirect)