CVE Feed

    Dashboard / CVE / CVE-2026-6414

    CVE-2026-6414

    @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.

    Published:Apr 16, 2026
    Last Modified:Apr 23, 2026
    EPS:Apr 16, 2026
    EPSS Score:0.00014
    CVSS Score:5.9

    Affected Products

    Vendor
    Fastify
    Product
    Fastify-static

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-18427 (CVSS 7.5) — @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static…
    CVE-2026-15074 (CVSS 7.5) — @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames …
    CVE-2026-7120 (CVSS 5.3) — @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separato…
    CVE-2026-6410 (CVSS 5.3) — @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the li…
    CVE-2021-22964 (CVSS 8.8) — A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers t…
    CVE-2021-22963 (CVSS 6.1) — A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect user…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High