Description

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T16:16:38.350Z",
  "pubdate": "2026-08-06T16:16:38.350Z",
  "executiveSummary": "A vulnerability exists in @fastify/static before version 10.1.3, specifically involving an incomplete fix for a previous route guard bypass. The vulnerability class is a route guard bypass leading to unauthorized file disclosure. The impact is the unauthorized disclosure of sensitive file contents located behind protected subtrees of the static root. Affected systems are Node.js applications utilizing @fastify/static where a subtree of the static root is protected by a route-based guard. Applications relying solely on the allowedPath option are not affected. The risk implication is that unauthenticated attackers can read restricted files without possessing valid credentials or permissions. The attacker capabilities include remote, unauthenticated file retrieval. Exploitation requirements involve applications implementing route-based guards to secure specific subtrees within the static file serving root.",
  "technicalDetails": "The root cause of the vulnerability stems from the static file handler's failure to adequately canonicalize input paths prior to executing route matching and delegating operations to the underlying send layer. Previously, the implementation only rejected parent directory segments, neglecting to canonicalize dot segments, duplicate slashes, encoded dots, or backslashes. Consequently, these non-canonical path forms fail to trigger route-based guards that protect specific subtrees, yet the underlying resolution mechanisms map the request back onto the protected file.\nThe vulnerable component is the static file handler within @fastify/static affecting versions prior to 10.1.3. The vulnerability is exploitable over the network by unauthenticated attackers requiring no special privileges. The attack flow proceeds as follows: an attacker crafts a malicious HTTP request targeting a protected file using a non-canonical path variant containing sequences such as dot segments, duplicate slashes, encoded dots, or backslashes. Because the input path is not canonicalized prior to route evaluation, the route-based guard fails to recognize the path as belonging to the protected subtree and permits the request. The request is subsequently delegated to the send layer, which resolves the non-canonical path to the targeted protected file on the filesystem. The server then responds by disclosing the sensitive contents of the file to the unauthenticated attacker. Post-exploitation impact is strictly limited to unauthorized read access of files residing within the static root directory exposed by the application."
}