Vulnerability advisory

GHSA-8pvw-jcv7-9cmj

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Published Jul 24, 2026Updated Jul 24, 2026OSV record ↗

Also known as CVE-2026-7120

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

@fastify/static npm

All @fastify/static advisories →

Affected	Fixed in
All versions before 10.1.2	`10.1.2`Advisories →

Description

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.