Fastifystatic - vulnerabilities (CVEs)

6 CVEs in 1 products, 0 in the last 30 days, newest from 2026-09-17.

Products

CVE-2026-90982 - CVSS 5.3 (medium), 2026-09-17: @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem…
CVE-2026-18427 - CVSS 7.5 (high), 2026-08-06: @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory…
CVE-2026-15074 - CVSS 7.5 (high), 2026-07-23: @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a…
CVE-2026-7120 - CVSS 5.3 (medium), 2026-07-23: @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution.…
CVE-2026-6410 - CVSS 5.3 (medium), 2026-04-16: @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves…
CVE-2026-6414 - CVSS 5.9 (medium), 2026-04-16: @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as…