CVE-2026-18427@fastify/static vulnerable to route guard bypass via non-canonical path segments
Updated under an hour ago ()
Does this affect you?
It affects @fastify/static and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-22, CWE-436
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openjs
- NVD analysis
- Analyzed
- Record last updated
- Aug 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
@fastify/static @fastify/static fastify_static:fastify_static (from the name) | before 10.1.3; 10.1.3 not affected | CNA record |
fastify fastify-static fastify:fastify-static | before 10.1.3 | NVD |
References
- https://github.com/fastify/fastify-static/security/advisories/GHSA-423g-23ch-w7c6mitigation, vendor-advisory
- https://cna.openjsf.org/security-advisories.htmlthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.