Path Traversal Vulnerability in @fastify/static Affected by File Resolution Issues

CVE-2026-15074

What is CVE-2026-15074?

The @fastify/static library, prior to version 10.1.1, is vulnerable to a path traversal issue due to inadequate handling of dot-dot path segments in request pathnames. This vulnerability allows unauthenticated attackers to bypass route-scoped middleware protections and access files residing within the static root directory, which should be safeguarded. Although access is limited to files under the designated URL prefix and does not extend outside the configured static root, this exposure can lead to sensitive data being disclosed unnecessarily. The issue stems from an ineffective remedy for a previous vulnerability, which only addressed encoded forward slashes, and highlights the importance of robust input validation mechanisms. The problem has been resolved in version 10.1.1.

References