Path Traversal Vulnerability in Fastify Static Plugin for Node.js

CVE-2026-7120

What is CVE-2026-7120?

The Fastify Static plugin for Node.js contains a vulnerability where the allowedPath callback is evaluated before normalizing path segments. This flaw allows an unauthenticated attacker to bypass path restrictions through non-canonical pathnames, potentially allowing access to files that should be restricted. Although the bypass itself does not grant access to files outside the static root directory, it compromises path-based access controls. All versions up to and including 10.1.1 are affected, with fixes provided in version 10.1.2.

References