CVE-2026-18427

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.3

Description An incomplete fix for a route guard bypass allows an unauthenticated attacker to access files protected by a route-based guard. The static file handler failed to canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and delegation to the send layer. By using a non-canonical path form, an attacker can bypass the guarded route to disclose the contents of protected files. This issue specifically affects applications that protect a subtree of the static root with a route-based guard, whereas those using the allowedPath option remain unaffected.

Recommendations Update @fastify/static to version 10.1.3.