PT-2026-33313 · Npm · Fastify-Static

Blakeembrey + 3 · CVE-2026-6414 · Published 2026-01-20 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @fastify/static versions 8.0.0 through 9.1.0

Description An authentication and authorization bypass exists due to inconsistent URL decoding between the Fastify router and the static file handler. The router treats percent-encoded path separators (%2F) as literal characters, while the static handler decodes them before filesystem resolution. This mismatch allows attackers to circumvent route-based middleware or guards intended to protect specific paths. For example, a request to /admin%2Fsecret.html may not match a guard for /admin/* but will still be resolved and served as /admin/secret.html by the static handler.

Recommendations Upgrade @fastify/static to version 9.1.1.

Exploit

Fix

Weakness Enumeration

CWE-177

Related Identifiers

CVE-2026-6414

GHSA-CXRG-G7R8-W69P

GHSA-Q5QW-H33P-QVWR

GHSA-X428-GHPX-8J92

Affected Products

Fastify-Static

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6414.json · Exploit
• https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22031 · Security Note
• https://osv.dev/vulnerability/CVE-2026-6414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6414 · Security Note
• https://osv.dev/vulnerability/GHSA-q5qw-h33p-qvwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29045 · Security Note
• https://osv.dev/vulnerability/GHSA-cxrg-g7r8-w69p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x428-ghpx-8j92 · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr · Note
• https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3 · Note
• https://github.com/fastify/fastify-static · Note
• https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p · Note
• https://github.com/fastify/middie · Note