Packages / @fastify/static / Security

ModerateVulnerabilityGHSA-x428-ghpx-8j92CVE-2026-6414Published 16 Apr 2026

@fastify/static vulnerable to route guard bypass via encoded path separators

Affected releases · @fastify/static

  • 9.x9.0.0 – 9.1.0Fixed in 9.1.1
  • 8.x8.0.0 – 8.3.0No fix on this line yet

On 9.x, the newest line:

npm install @fastify/static@9.1.1
10.x

  1. Not affected

    10.0.0 – 10.1.7

    9 releases, latest

9.x

  1. Affected

    9.0.0 – 9.1.0

    2 releases

  2. Fixed

    9.1.1 – 9.3.0

    5 releases

8.x

  1. Affected

    8.0.0 – 8.3.0

    9 releases

54 stable releases of @fastify/static, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @fastify/static. It is read in your browser and sent nowhere.

What happens

Impact

@fastify/static v9.1.0 and earlier decodes percent-encoded path separators (%2F) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/* do not match /admin%2Fsecret.html, but @fastify/static decodes it to /admin/secret.html and serves the file.

Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

None. Upgrade to the patched version.