---
id: CVE-2026-18427
title: >-
  @fastify/static before version 10.1.3 contains an incomplete fix for a
  previous route guard bypass
summary: >-
  @fastify/static before version 10.1.3 contains an incomplete fix for a
  previous route guard bypass. The static file handler rejected only parent
  directory segments, but it did not canonicalize dot segments, duplicate
  slashes, encoded dot…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
  - CWE-436
  - CWE-41
published: '2026-08-06'
updated: '2026-08-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18427'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://github.com/fastify/fastify-static/security/advisories/GHSA-423g-23ch-w7c6
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18427.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18427'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512116'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-18427'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18427'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00659
epssPercentile: 0.49403
ingestedAt: '2026-08-29T16:39:14.311Z'
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
  - openshift_dev_spaces
---

## Overview

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18427.json)