File Access Vulnerability in Fastify Plugin by Fastify

CVE-2026-90982

What is CVE-2026-90982?

The @fastify/static plugin, which serves static files from a configured root directory, is susceptible to a path manipulation vulnerability on case-insensitive filesystems, like those used in Windows and macOS. In versions prior to 10.1.4, an attacker could bypass route guards or allowedPath restrictions by changing the letter case of a path segment. This flaw allows unauthorized access to protected files, as the case-sensitive nature of the route matcher fails to recognize the altered case of a request. Although this does not affect case-sensitive filesystems, it poses significant risks in misconfigured environments. The issue has been addressed in version 10.1.4 with a fix that ensures that the requested path is validated against its actual on-disk spelling to prevent case-aliasing. Users are advised to either upgrade or serve files from case-sensitive filesystems.

References