Packages / @fastify/static / Security

ModerateVulnerabilityGHSA-8pvw-jcv7-9cmjCVE-2026-7120Published 24 Jul 2026

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Affected releases · @fastify/static

  • 10.x10.0.0 – 10.1.1Fixed in 10.1.2
  • 9.x9.0.0 – 9.3.0No fix on this line yet
  • 8.x and older5.0.0 – 8.3.0No fix, no longer updated

On 10.x, the newest line:

npm install @fastify/static@10.1.2
10.x

  1. Affected

    10.0.0 – 10.1.1

    3 releases

  2. Fixed

    10.1.2 – 10.1.7

    6 releases, latest

9.x

  1. Affected

    9.0.0 – 9.3.0

    7 releases

8.x

  1. Affected

    8.0.0 – 8.3.0

    9 releases

7.x

  1. Affected

    7.0.0 – 7.0.4

    5 releases

6.x

  1. Affected

    6.0.0 – 6.12.0

    21 releases

5.x

  1. Affected

    5.0.0 – 5.0.2

    3 releases

54 stable releases of @fastify/static, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @fastify/static. It is read in your browser and sent nowhere.

What happens

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.