CyberRota Analysis
AI-GeneratedApplications using @fastify/static versions prior to 10.1.3 are vulnerable to a route guard bypass that allows unauthenticated attackers to access protected files through non-canonical path forms. This vulnerability could lead to unauthorized disclosure of sensitive file contents, making it critical for developers and organizations utilizing this package to upgrade to version 10.1.3 or later. Prioritization is essential for those with applications that implement route-based guards on static file serving.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.