TI-2026-06243 Aliases CVE-2026-7120 GHSA-8pvw-jcv7-9cmj

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

LOW 30CWE-180Published 2026-07-23 · Updated 2026-07-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00369 30th percentileScored 2026-11-07

Fix Partial @fastify/static (@fastify/static): 10.1.2@fastify/static (npm): 10.1.2Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fastify	@fastify/static	before 10.1.2	10.1.2	Patch available	CNA
—	@fastify/static (npm)	before 10.1.2	10.1.2	Patch available	GHSA-8pvw-jcv7-9cmj

@fastify/static Vendorfastify Affected before 10.1.2 Fixed in 10.1.2 Patch available CNA
@fastify/static (npm) Vendor— Affected before 10.1.2 Fixed in 10.1.2 Patch available GHSA-8pvw-jcv7-9cmj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fastify:fastify-static::::::::	before 10.1.2	Vulnerable	fastify

cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:* Versions before 10.1.2 Vulnerable ·fastify

Remediation

Fix · CNA @fastify/static (@fastify/static) Fixed in 10.1.2
Fix · GHSA-8pvw-jcv7-9cmj @fastify/static (npm) Fixed in 10.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat OpenShift AI (RHOAI)

Timeline

2026-10-02 Threatist record created from CVE-2026-7120
2026-10-03 Alias added: GHSA-8pvw-jcv7-9cmj
2026-11-04 Affected versions changed · Red Hat
2026-11-04 CVSS score added · Red Hat

References

Advisory 3

Other 3

TI-2026-15143 @fastify/static vulnerable to route guard bypass via non-canonical path segments CVSS 3.1HIGH 7.5
TI-2026-12689 @fastify/static vulnerable to route guard bypass via path traversal CVSS 3.1HIGH 7.5
TI-2021-05825 Uncontrolled resource consumption in https://github.com/fastify/fastify-static CVSS 3.1HIGH 8.8
TI-2026-05626 @fastify/static vulnerable to path traversal in directory listing CVSS 3.1MEDIUM 5.3
TI-2021-05824 Open redirect in https://github.com/fastify/fastify-static CVSS 3.1MEDIUM 6.1
TI-2026-05629 @fastify/static vulnerable to route guard bypass via encoded path separators CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences