CVE-2026-6414
Medium
Description
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.
SeverityMedium
CVSS5.9
Exploit probability—
Product
@fastify/static
PublishedApr 16, 2026
First seenApr 16, 2026
Weakness typeCWE-177CWE-177
How to fix
Update
- @fastify/static9.1.1 or later
- fastify fastify-static9.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @fastify/staticnpm | 8.0.0 ≤ v < 9.1.1 | 9.1.1 |
| fastify fastify-static | 8.0.0 ≤ v < 9.1.1 | 9.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.