CVE-2026-15074

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.1

Description An unauthenticated attacker can bypass route-scoped middleware and guards by using non-leading .. and %2E%2E path segments in request pathnames. This occurs because the find-my-way router does not normalize dot-dot segments during route matching, causing requests to match the static plugin's catch-all instead of guarded routes. The getPathnameForSend() helper fails to reject these segments before the file-resolution stage, and the underlying @fastify/send library normalizes them before applying its own path-traversal guard. This allows the reading of files within the configured static root that are intended to be protected by URL prefix guards, although it does not allow access to files outside the static root.

Recommendations Upgrade to @fastify/static version 10.1.1. As a temporary workaround, do not use route-based middlewares or guards to protect files served by @fastify/static.