Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-7120: Fastify static may serve restricted files via odd URLs
CVE-2026-7120 · published 3 months ago
Summary
The Fastify static file plugin (versions up to 10.1.1) checks its allow‑list before cleaning up unusual parts of a URL. An attacker could use specially crafted paths to get files that were meant to be blocked. Upgrade to version 10.1.2 or later to fix the issue.
What to do
- Update fastify static to version 10.1.2.
- Update @fastify/static @fastify/static to version 10.1.2 or later.
- Update fastify fastify-static to version 10.1.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | @fastify/static | @fastify/static | < 10.1.2 |
| npm | fastify | static |
<= 10.1.1 Fix: upgrade to 10.1.2
|
| – | fastify | fastify-static |
< 10.1.2 cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:* |
Original advisory text
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-7120 Vendor Advisory
- https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf780570...
- https://github.com/fastify/fastify-static/releases/tag/v10.1.2
- https://github.com/advisories/GHSA-8pvw-jcv7-9cmj
- https://cna.openjsf.org/security-advisories.html Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7120.j... Vendor Advisory
- https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cm... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-180Incorrect Behavior Order: Validate Before Canonicalize
Timeline
Published23 Jul 2026
Updated4 Nov 2026
First seen23 Jul 2026
Track software like this
Free during beta