CVE-2026-6414

Name of the Vulnerable Software and Affected Versions @fastify/static versions 8.0.0 through 9.1.0

Description An authentication and authorization bypass exists due to inconsistent URL decoding between the Fastify router and the static file handler. The router treats percent-encoded path separators (%2F) as literal characters, while the static handler decodes them before filesystem resolution. This mismatch allows attackers to circumvent route-based middleware or guards intended to protect specific paths. For example, a request to /admin%2Fsecret.html may not match a guard for /admin/* but will still be resolved and served as /admin/secret.html by the static handler.

Recommendations Upgrade @fastify/static to version 9.1.1.