TI-2026-05629 Aliases CVE-2026-6414 GHSA-x428-ghpx-8j92

@fastify/static vulnerable to route guard bypass via encoded path separators

LOW 27CWE-177Published 2026-04-16 · Updated 2026-04-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00422 36th percentileScored 2026-11-07

Fix Partial @fastify/static (@fastify/static): 9.1.1@fastify/static (npm): 9.1.1Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fastify	@fastify/static	8.0.0 to before 9.1.1	9.1.1	Patch available	CNA
—	@fastify/static (npm)	8.0.0 to before 9.1.1	9.1.1	Patch available	GHSA-x428-ghpx-8j92

@fastify/static Vendorfastify Affected 8.0.0 to before 9.1.1 Fixed in 9.1.1 Patch available CNA
@fastify/static (npm) Vendor— Affected 8.0.0 to before 9.1.1 Fixed in 9.1.1 Patch available GHSA-x428-ghpx-8j92

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fastify:fastify-static::::::::	8.0.0 to before 9.1.1	Vulnerable	fastify

cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:* Versions 8.0.0 to before 9.1.1 Vulnerable ·fastify

Remediation

Fix · CNA @fastify/static (@fastify/static) Fixed in 9.1.1
Fix · GHSA-x428-ghpx-8j92 @fastify/static (npm) Fixed in 9.1.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-04-16
@fastify/static 9.1.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-05626 @fastify/static vulnerable to path traversal in directory listingPriority LOW 31
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-6414
2026-10-03 Alias added: GHSA-x428-ghpx-8j92

References

Advisory 3

Other 3

TI-2026-15143 @fastify/static vulnerable to route guard bypass via non-canonical path segments CVSS 3.1HIGH 7.5
TI-2026-12689 @fastify/static vulnerable to route guard bypass via path traversal CVSS 3.1HIGH 7.5
TI-2021-05825 Uncontrolled resource consumption in https://github.com/fastify/fastify-static CVSS 3.1HIGH 8.8
TI-2026-05626 @fastify/static vulnerable to path traversal in directory listing CVSS 3.1MEDIUM 5.3
TI-2026-06243 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVSS 3.1MEDIUM 5.3
TI-2021-05824 Open redirect in https://github.com/fastify/fastify-static CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences