CVE-2026-15074: @fastify/static vulnerable to route guard bypass via path traversal
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1.
Other sources
Impact
@fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded /deep/. The getPathnameForSend helper introduced by the fix for GHSA-x428-ghpx-8j92 only guards against the %2F variant; .. and %2E%2E survive the decodeURI + encodeURI round-trip and are then collapsed away by @fastify/send's path.normalize before its own traversal guard runs.
Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with non-leading dot-dot path segments.
Patches
Upgrade to @fastify/static 10.1.1.
Workarounds
Do not use route-based middlewares or guards to protect files served by @fastify/static.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@fastify/staticto a version that resolves this vulnerability.Fixed in 10.1.1 - Upgrade
Upgrade
@fastify/staticto a version that resolves this vulnerability.Fixed in 10.1.1 - Configuration
Do not rely on route-based middleware/guards (that are scoped to the guarded URL prefix) to protect files served by @fastify/static; the bypass can defeat route-guard filtering via non-leading '..' and '%2E%2E' path segments.
Applications using @fastify/static Do not use route-based middleware or guards to protect files served by @fastify/static = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15074?
CVE-2026-15074 has a severity rating of 7.5, classified as high.
How do I fix CVE-2026-15074?
To fix CVE-2026-15074, upgrade the @fastify/static package to version 10.1.1 or later.
What type of vulnerability is CVE-2026-15074?
CVE-2026-15074 is a path traversal vulnerability.
What versions of @fastify/static are affected by CVE-2026-15074?
Versions of @fastify/static up to and including 10.1.0 are affected by CVE-2026-15074.
What is the main issue with CVE-2026-15074?
CVE-2026-15074 allows for a route guard bypass due to failure in rejecting dot-dot path segments before file resolution.