TI-2026-12689 Aliases CVE-2026-15074 GHSA-83w8-p2f5-377r

@fastify/static vulnerable to route guard bypass via path traversal

MEDIUM 40CWE-22Published 2026-07-23 · Updated 2026-07-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00672 52nd percentileScored 2026-11-07

Fix Partial @fastify/static (@fastify/static): 10.1.1@fastify/static (npm): 10.1.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fastify	@fastify/static	before 10.1.1	10.1.1	Patch available	CNA
—	@fastify/static (npm)	before 10.1.1	10.1.1	Patch available	GHSA-83w8-p2f5-377r

@fastify/static Vendorfastify Affected before 10.1.1 Fixed in 10.1.1 Patch available CNA
@fastify/static (npm) Vendor— Affected before 10.1.1 Fixed in 10.1.1 Patch available GHSA-83w8-p2f5-377r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fastify:fastify-static::::::::	before 10.1.1	Vulnerable	fastify

cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:* Versions before 10.1.1 Vulnerable ·fastify

Remediation

Fix · CNA @fastify/static (@fastify/static) Fixed in 10.1.1
Fix · GHSA-83w8-p2f5-377r @fastify/static (npm) Fixed in 10.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet
Red Hat OpenShift Dev Spaces	Affected	No fix yet

Not affected: 1 product

Red Hat OpenShift AI (RHOAI)

Timeline

2026-10-02 Threatist record created from CVE-2026-15074
2026-10-03 Alias added: GHSA-83w8-p2f5-377r
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Advisory 3

Other 3

TI-2026-15143 @fastify/static vulnerable to route guard bypass via non-canonical path segments CVSS 3.1HIGH 7.5
TI-2021-05825 Uncontrolled resource consumption in https://github.com/fastify/fastify-static CVSS 3.1HIGH 8.8
TI-2026-05626 @fastify/static vulnerable to path traversal in directory listing CVSS 3.1MEDIUM 5.3
TI-2026-06243 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVSS 3.1MEDIUM 5.3
TI-2021-05824 Open redirect in https://github.com/fastify/fastify-static CVSS 3.1MEDIUM 6.1
TI-2026-05629 @fastify/static vulnerable to route guard bypass via encoded path separators CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences