Imssm99

**Name of the Vulnerable Software and Affected Versions** @fastify/static versions prior to 10.1.1 **Description** An unauthenticated attacker can bypass route-scoped middleware and guards by using non-leading `..` and `%2E%2E` path segments in request pathnames. This occurs because the `find-my-way` router does not normalize dot-dot segments during route matching, causing requests to match the static plugin's catch-all instead of guarded routes. The `getPathnameForSend()` helper fails to reject these segments before the file-resolution stage, and the underlying `@fastify/send` library normalizes them before applying its own path-traversal guard. This allows the reading of files within the configured static root that are intended to be protected by URL prefix guards, although it does not allow access to files outside the static root. **Recommendations** Upgrade to @fastify/static version 10.1.1. As a temporary workaround, do not use route-based middlewares or guards to protect files served by @fastify/static.