CVE-2026-7120

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.2

Description An unauthenticated attacker can bypass path-based filtering because the allowedPath callback is evaluated before the normalization of dot segments and duplicate path separators in the pathname used for file resolution. By requesting non-canonical pathnames, such as //file, /./file, or /public/../private/file, an attacker can access files that were intended to be denied. This issue defeats the security boundary established by allowedPath but does not allow access outside the configured static root.

Recommendations Upgrade to @fastify/static version 10.1.2 or later.