Read the docs
TI-2026-15143 Aliases CVE-2026-18427

@fastify/static vulnerable to route guard bypass via non-canonical path segments

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00659 51st percentileScored 2026-11-07
Fix Partial @fastify/static (@fastify/static): 10.1.3Red Hat: 4 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/staticbefore 10.1.310.1.3Patch availableCNA
  • @fastify/static Vendorfastify Affected before 10.1.3 Fixed in 10.1.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:*before 10.1.3Vulnerablefastify
  • cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:* Versions before 10.1.3 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/static (@fastify/static) Fixed in 10.1.3

Red Hat 4 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
Show 1 more Red Hat advisories
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 4 products
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Dev Spaces 3.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18427
  2. 2026-10-09 EPSS moved to the 50th–90th percentile
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  6. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  7. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  8. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 2

  • TI-2026-12689 @fastify/static vulnerable to route guard bypass via path traversal CVSS 3.1HIGH 7.5
  • TI-2021-05825 Uncontrolled resource consumption in https://github.com/fastify/fastify-static CVSS 3.1HIGH 8.8
  • TI-2026-05626 @fastify/static vulnerable to path traversal in directory listing CVSS 3.1MEDIUM 5.3
  • TI-2026-06243 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVSS 3.1MEDIUM 5.3
  • TI-2021-05824 Open redirect in https://github.com/fastify/fastify-static CVSS 3.1MEDIUM 6.1
  • TI-2026-05629 @fastify/static vulnerable to route guard bypass via encoded path separators CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences