CVE-2026-7120
Received Received - Intake

Path Traversal in Fastify Static

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: openjs

Description
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-7120
EUVD
EUVD-2026-47870

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fastify static to 10.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-180 The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the @fastify/static package versions up to 10.1.1. It allows an attacker to bypass security restrictions by using non-canonical URL paths like //file, /./file, or /public/../private/file. These paths resolve to the same files on disk but bypass the allowedPath callback that is meant to restrict access.

Detection Guidance

To detect this vulnerability, check if your system is running @fastify/static versions up to 10.1.1. Use commands like 'npm list @fastify/static' or 'npm ls @fastify/static' to verify the installed version. If the version is 10.1.1 or lower, the system is vulnerable.

Impact Analysis

If your application uses @fastify/static with versions up to 10.1.1 and relies on allowedPath to restrict file access, attackers could access files that were intended to be denied. This could lead to unauthorized exposure of sensitive data within the configured static root directory.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, potentially violating data protection requirements under GDPR or HIPAA. If restricted files containing personal or health data are exposed, it may result in non-compliance with these regulations.

Mitigation Strategies

Immediately upgrade @fastify/static to version 10.1.2 or later. Use commands like 'npm update @fastify/static' or 'npm install @fastify/static@latest' to apply the patch. Ensure no other dependencies are forcing an older version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart