{"id":"CVE-2026-7120","aliases":["GHSA-8pvw-jcv7-9cmj"],"title":"@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths","summary":"@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths","severity":"medium","cvss":5.3,"cwe":["CWE-180"],"vendor":"fastify","product":"@fastify/static","ecosystem":"npm","affected":["@fastify/static <= 10.1.1"],"patched":["@fastify/static 10.1.2"],"published":"2026-07-24","updated":"2026-07-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-8pvw-jcv7-9cmj","references":[{"url":"https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7120"},{"url":"https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fastify-static/releases/tag/v10.1.2"},{"url":"https://github.com/advisories/GHSA-8pvw-jcv7-9cmj"}],"tags":["ghsa","npm"],"epss":0.00369,"epssPercentile":0.30631,"ingestedAt":"2026-07-24T17:34:27.724Z","slug":"CVE-2026-7120","body":"## Overview\n\n### Impact\n\n`@fastify/static` evaluates the `allowedPath` callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as `//file`, `/./file`, or `/public/../private/file` bypass `allowedPath` filtering while resolving to the intended file on disk.\n\nApplications that use `allowedPath` as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.\n\n### Patches\n\nUpgrade to `@fastify/static` >= 10.1.2.\n\n### Workarounds\n\nNone. Upgrade to the patched version.\n\n## Affected packages\n\n- `@fastify/static <= 10.1.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@fastify/static 10.1.2`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}