What’s Vulnerable › Vulnerabilities

CVE-2026-7120: @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-23 · updated 2026-07-28
• Weakness: CWE-180

Description

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.

Affected products

• https://github.com/fastify/fastify-static: before 10.1.2 — fixed in 10.1.2

How to fix

Upgrade to a fixed version: https://github.com/fastify/fastify-static 10.1.2. Check the vendor advisory for mitigations.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj

Get alerted when CVE-2026-7120 or the next vulnerability affects your stack