GitHub Advisoryadvisory · npm

GHSA-8pvw-jcv7-9cmj @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

MEDIUM Published 2026-07-24 Modified 2026-07-24 Official page ↗
Aliases
CVE-2026-7120
Ecosystem
npm
Packages
@fastify/static
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-180
Reviewed
2026-07-24

Affected packages

• npm @fastify/static: < 10.1.2 → fixed in 10.1.2

Description

Impact `@fastify/static` evaluates the `allowedPath` callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as `//file`, `/./file`, or `/public/../private/file` bypass `allowedPath` filtering while resolving to the intended file on disk. Applications that use `allowedPath` as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied. Patches Upgrade to `@fastify/static` >= 10.1.2. Workarounds None. Upgrade to the patched version.

Related

Alias · CVE (1)

  • CVE-2026-7120 @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for… vulnerability

Weakness · CWE (1)

  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize weakness

References