fastify-static vulnerabilities

Latest fastify-static CVEs

Newest publication first

1. CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments

   Published 2026-08-06

   High·CVSS 7.5 EPSS 0.66%

   @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and...

2. CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal

   Published 2026-07-23

   High·CVSS 7.5 EPSS 0.67%

   @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library n...

3. CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

   Published 2026-07-23

   Medium·CVSS 5.3 EPSS 0.37%

   @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesti...

4. CVE-2026-6410 @fastify/static vulnerable to path traversal in directory listing

   Published 2026-04-16

   Medium·CVSS 5.3 EPSS 0.51%

   @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated att...

5. CVE-2026-6414 @fastify/static vulnerable to route guard bypass via encoded path separators

   Published 2026-04-16

   Medium·CVSS 5.9 EPSS 0.42%

   @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by...

6. CVE-2021-22963 URL Redirection to Untrusted Site ('Open Redirect') in fastify-static

   Published 2021-10-14

   Medium·CVSS 6.1 EPSS 1.2%

   A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//google.com/%2e%2e.The issue shows up on all the fastify-static applications tha...

7. CVE-2021-22964 DOS and Open Redirect with user input

   Published 2021-10-14

   High·CVSS 8.8 EPSS 1.0%

   A redirect vulnerability in the fastify-static module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash // followed by a domain: http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e.A DOS vulnerability...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.