TI-2026-15143 CVE-2026-18427
@fastify/static vulnerable to route guard bypass via non-canonical path segments
Priority MEDIUM 40
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass.
fastify
Records77All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high37CVSS 7.0–8.9
Exploited now
fastify records in CISA KEVNo fastify vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records in Fastify-static · all components
TI-2026-12689 CVE-2026-15074 · GHSA-83w8-p2f5-377r
@fastify/static vulnerable to route guard bypass via path traversal
Priority MEDIUM 40
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage.
TI-2021-05825 CVE-2021-22964 · GHSA-pgh6-m65r-2rhq
Uncontrolled resource consumption in https://github.com/fastify/fastify-static
Priority MEDIUM 40
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://l…
TI-2026-05626 CVE-2026-6410 · GHSA-pr96-94w5-mx2h
@fastify/static vulnerable to path traversal in directory listing
Priority LOW 31
@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option.
TI-2026-06243 CVE-2026-7120 · GHSA-8pvw-jcv7-9cmj
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
Priority LOW 30
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution.
TI-2021-05824 CVE-2021-22963 · GHSA-p6vg-p826-qp3v
Open redirect in https://github.com/fastify/fastify-static
Priority LOW 30
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.T…
TI-2026-05629 CVE-2026-6414 · GHSA-x428-ghpx-8j92
@fastify/static vulnerable to route guard bypass via encoded path separators
Priority LOW 27
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters.