PT-2026-33313 · Npm · Fastify-Static

Blakeembrey + 3 · Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-6414

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @fastify/static versions 8.0.0 through 9.1.0

Description @fastify/static decodes percent-encoded path separators ('%2F') before filesystem resolution, whereas the Fastify router treats them as literal characters. This discrepancy allows for a routing mismatch where route guards or middleware protecting specific paths can be bypassed. For instance, a guard protecting '/admin/*' will not match a request for '/admin%2Fsecret.html', but the software will decode the request and serve the file from '/admin/secret.html'.

Recommendations Upgrade to @fastify/static version 9.1.1.

Fix

Weakness Enumeration

CWE-177

Related Identifiers

CVE-2026-6414

GHSA-X428-GHPX-8J92

Affected Products

Fastify-Static

References · 10

• https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6414 · Security Note
• https://osv.dev/vulnerability/GHSA-x428-ghpx-8j92 · Vendor Advisory
• https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr · Note
• https://github.com/fastify/fastify-static · Note
• https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p · Note
• https://twitter.com/kom_256/status/2044766601203859626 · Twitter Post
• https://twitter.com/CVEnew/status/2045102683334250943 · Twitter Post
• https://twitter.com/infoflowcloud/status/2045105255675842845 · Twitter Post
• https://cna.openjsf.org/security-advisories.html · Note