CyberRota Analysis
AI-GeneratedThe @fastify/static package, up to version 10.1.0, is vulnerable to a path traversal attack due to its failure to properly reject dot-dot path segments, allowing unauthenticated attackers to bypass route-scoped middleware and access files within the static root. This vulnerability can lead to unauthorized file access, undermining the security of applications using this package. Developers and system administrators utilizing @fastify/static should prioritize upgrading to version 10.1.1 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)