Fastify Static Package Vulnerable to Route Guard Bypass via Path Traversal

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in @fastify/static, affecting version(s) multiple. The overall risk/impact is moderate to high.

CVE-2026-15074 (CVSS 7.5 — High): A vulnerability exists in @fastify/static due to route guard bypass via path traversal. An attacker can exploit this vulnerability.[emaillocker id="1283"]

CVE-2026-7120: @fastify/static is vulnerable to Authorization Bypass via Non-Canonical URL Paths. These vulnerabilities collectively present a moderate to high risk, particularly for administrators who manage @fastify/static instances. These vulnerabilities collectively present a moderate to high risk, particularly for administrators who manage @fastify/static instances.

These vulnerabilities collectively present a moderate to high risk, particularly for administrators who manage @fastify/static instances.

RECOMMENDATION:

We recommend you to update @fastify/static to the version 10.1.1 or 10.1.2.

REFERENCES:

The following reports contain further technical details:

• https://github.com/advisories/GHSA-83w8-p2f5-377r