---
id: CVE-2026-15074
aliases:
  - GHSA-83w8-p2f5-377r
title: '@fastify/static vulnerable to route guard bypass via path traversal'
summary: '@fastify/static vulnerable to route guard bypass via path traversal'
severity: high
cvss: 7.5
cwe:
  - CWE-22
vendor: fastify
product: '@fastify/static'
ecosystem: npm
affected:
  - '@fastify/static <= 10.1.0'
patched:
  - '@fastify/static 10.1.1'
published: '2026-07-24'
updated: '2026-07-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-83w8-p2f5-377r'
references:
  - url: >-
      https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15074'
  - url: >-
      https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/fastify/fastify-static/releases/tag/v10.1.1'
  - url: 'https://github.com/advisories/GHSA-83w8-p2f5-377r'
tags:
  - ghsa
  - npm
epss: 0.00672
epssPercentile: 0.50644
ingestedAt: '2026-07-24T17:34:27.748Z'
---

## Overview

### Impact

`@fastify/static` is vulnerable to a bypass of route-based middleware and guards via non-leading `..` and `%2E%2E` path segments. `find-my-way` does not normalize `..` when matching routes, so a request such as `/foo/../deep/secret.txt` matches the static plugin's catch-all instead of the guarded `/deep/*`. The `getPathnameForSend` helper introduced by the fix for [GHSA-x428-ghpx-8j92](https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92) only guards against the `%2F` variant; `..` and `%2E%2E` survive the `decodeURI` + `encodeURI` round-trip and are then collapsed away by `@fastify/send`'s `path.normalize` before its own traversal guard runs.

Applications that rely on route-based middleware or guards to protect files served by `@fastify/static` can be bypassed with non-leading dot-dot path segments.

### Patches

Upgrade to `@fastify/static` 10.1.1.

### Workarounds

Do not use route-based middlewares or guards to protect files served by `@fastify/static`.

## Affected packages

- `@fastify/static <= 10.1.0`

## Remediation

Upgrade to a patched release:

- `@fastify/static 10.1.1`