Path Traversal in Fastify Static

Executive Summary

CVE-2026-15074 is a path traversal vulnerability in the @fastify/static package versions up to 10.1.0. It allows bypassing route-based middleware and guards by using dot-dot path segments in request paths. The issue occurs because the underlying send library normalizes these segments before applying its own path-traversal protection, enabling unauthorized access to files within the static root directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running @fastify/static version 10.1.0 or earlier. Use commands like 'npm list @fastify/static' or 'npm ls @fastify/static' to verify the installed version. Inspect server logs for unusual path traversal attempts, such as requests containing '..' or '%2E%2E' in the URL path.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to bypass security controls and read sensitive files served by the static plugin. While it does not grant access outside the static root directory, it defeats route-guard filtering, potentially exposing confidential data like configuration files or internal documents.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, violating data protection requirements under GDPR and HIPAA. Exposure of personal or health data may result in non-compliance, legal penalties, and reputational damage due to insufficient access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade @fastify/static to version 10.1.1 or later using 'npm update @fastify/static'. As a temporary workaround, avoid relying on route-based middleware or guards for protecting files served by the package. Ensure no sensitive files are exposed under the static root directory.

Useful 0 Not Useful 0