---
id: CVE-2026-7120
aliases:
  - GHSA-8pvw-jcv7-9cmj
title: '@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths'
summary: '@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths'
severity: medium
cvss: 5.3
cwe:
  - CWE-180
vendor: fastify
product: '@fastify/static'
ecosystem: npm
affected:
  - '@fastify/static <= 10.1.1'
patched:
  - '@fastify/static 10.1.2'
published: '2026-07-24'
updated: '2026-07-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8pvw-jcv7-9cmj'
references:
  - url: >-
      https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7120'
  - url: >-
      https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/fastify/fastify-static/releases/tag/v10.1.2'
  - url: 'https://github.com/advisories/GHSA-8pvw-jcv7-9cmj'
tags:
  - ghsa
  - npm
epss: 0.00369
epssPercentile: 0.28012
ingestedAt: '2026-07-24T17:34:27.724Z'
---

## Overview

### Impact

`@fastify/static` evaluates the `allowedPath` callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as `//file`, `/./file`, or `/public/../private/file` bypass `allowedPath` filtering while resolving to the intended file on disk.

Applications that use `allowedPath` as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

### Patches

Upgrade to `@fastify/static` >= 10.1.2.

### Workarounds

None. Upgrade to the patched version.

## Affected packages

- `@fastify/static <= 10.1.1`

## Remediation

Upgrade to a patched release:

- `@fastify/static 10.1.2`