CVE-2026-7120
Medium
Description
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
SeverityMedium
CVSS5.3
Exploit probability—
Product
@fastify/static
PublishedJul 23, 2026
First seenJul 23, 2026
Weakness typeCWE-180CWE-180
How to fix
Update
- @fastify/static10.1.2 or later
- fastify fastify-static10.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @fastify/staticnpm | v < 10.1.2 | 10.1.2 |
| fastify fastify-static | v < 10.1.2 | 10.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.