TI-2026-15143 CVE-2026-18427
@fastify/static vulnerable to route guard bypass via non-canonical path segments
Priority MEDIUM 40
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass.
Vulnerabilities
7 records
TI-2026-12689 CVE-2026-15074 · GHSA-83w8-p2f5-377r
@fastify/static vulnerable to route guard bypass via path traversal
Priority MEDIUM 40
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage.
TI-2026-06243 CVE-2026-7120 · GHSA-8pvw-jcv7-9cmj
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
Priority LOW 30
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution.
TI-2026-05626 CVE-2026-6410 · GHSA-pr96-94w5-mx2h
@fastify/static vulnerable to path traversal in directory listing
Priority LOW 31
@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option.
TI-2026-05629 CVE-2026-6414 · GHSA-x428-ghpx-8j92
@fastify/static vulnerable to route guard bypass via encoded path separators
Priority LOW 27
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters.
TI-2021-05824 CVE-2021-22963 · GHSA-p6vg-p826-qp3v
Open redirect in https://github.com/fastify/fastify-static
Priority LOW 30
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.T…
TI-2021-05825 CVE-2021-22964 · GHSA-pgh6-m65r-2rhq
Uncontrolled resource consumption in https://github.com/fastify/fastify-static
Priority MEDIUM 40
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://l…