CVE-2026-6414: @fastify/static vulnerable to route guard bypass via encoded path separators
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.
Other sources
Impact
@fastify/static v9.1.0 and earlier decodes percent-encoded path separators (%2F) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/ do not match /admin%2Fsecret.html, but @fastify/static decodes it to /admin/secret.html and serves the file.
Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.
Patches
Upgrade to @fastify/static >= 9.1.1.
Workarounds
None. Upgrade to the patched version.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@fastify/staticto a version that resolves this vulnerability.Fixed in 9.1.1 - Upgrade
Upgrade
@fastify/staticto a version that resolves this vulnerability.Fixed in 9.1.1 - Compensating control
If you cannot upgrade immediately, do not rely on route guards/middleware protecting paths served by @fastify/static, since attackers can bypass them by encoding path separators as %2F (e.g., accessing /admin%2Fsecret.html to reach /admin/secret.html).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6414?
CVE-2026-6414 is considered a high severity vulnerability due to its potential to allow attackers to bypass route guards.
How do I fix CVE-2026-6414?
To fix CVE-2026-6414, upgrade @fastify/static to version 9.1.1 or later, which contains the necessary patches.
Which versions of @fastify/static are affected by CVE-2026-6414?
@fastify/static versions from 8.0.0 to 9.1.0 are affected by CVE-2026-6414.
What is the primary vulnerability mechanism of CVE-2026-6414?
CVE-2026-6414 allows attackers to bypass file system resolution by exploiting the mismatch between percent-encoded path separators and Fastify's routing behavior.
What are the consequences of exploiting CVE-2026-6414?
Exploiting CVE-2026-6414 can lead to unauthorized access to routes that should be protected, potentially exposing sensitive data or operations.