CVE-2026-7120Medium· 5.3▾ Sunlit@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.4%
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.
Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.
Upgrade to @fastify/static >= 10.1.2.
None. Upgrade to the patched version.
@fastify/static <= 10.1.1Upgrade to a patched release:
@fastify/static 10.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15074High· 7.5@fastify/static vulnerable to route guard bypass via path traversal
CVE-2026-90982Medium· 5.3@fastify/static is a Fastify plugin that serves static files from a configured root directory
CVE-2026-18504Medium· 5.4fastify vulnerable to schema validation bypass via root primitive coercion mismatch
CVE-2026-16732Medium· 6.1fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
CVE-2026-92081Medium· 5.9fastify is a fast and low-overhead web framework for Node.js
CVE-2026-85124High· 7.5@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream