Npm · Fastify-Static · CVE-2026-90982
**Name of the Vulnerable Software and Affected Versions**
@fastify/static versions prior to 10.1.4
**Description**
On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or `allowedPath` restriction can be bypassed by altering the letter case of a path segment. This occurs because the route matcher is case-sensitive while the filesystem is not; a request with a modified case does not match the guarded route and is passed to the static handler, which the filesystem then resolves to the protected file. Consequently, unauthenticated requests can read files intended to be protected. This issue is not a directory traversal as it does not allow access to files outside the configured root, and it does not affect case-sensitive filesystems.
**Recommendations**
Update to version 10.1.4.
Serve static files from a case-sensitive filesystem.
Ensure route guards and `allowedPath` rules account for every letter-case variant of the protected paths.