CVE-2026-6414
@fastify/static vulnerable to route guard bypass via encoded path separators
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.
| CWE | CWE-177 |
| Vendor | @fastify/static |
| Product | @fastify/static |
| Published | Apr 16, 2026 |
| Last Updated | Apr 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for @fastify/static @fastify/static
Be the first to know when new medium vulnerabilities affecting @fastify/static @fastify/static are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
@fastify/static / @fastify/static
8.0.0 < 9.1.1
References
github.com: https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p github.com: https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr github.com: https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92 cna.openjsf.org: https://cna.openjsf.org/security-advisories.html
Credits
🔍 blakeembrey mcollina UlisesGascon climba03003