CVE-2026-15074: @fastify/static Path Traversal Vulnerability

CVE-2026-15074 Overview

CVE-2026-15074 is a path traversal vulnerability [CWE-22] in the @fastify/static plugin up to and including version 10.1.0. The plugin fails to reject dot-dot (..) path segments in request pathnames before the file-resolution stage. This defect bypasses the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. An unauthenticated network attacker can defeat route-scoped middleware and read files inside the static root that sit under a guarded URL prefix. The maintainers patched the issue in @fastify/static10.1.1.

Critical Impact
Unauthenticated attackers can bypass route-guard middleware and access protected files served from the configured static root over the network without user interaction.

Affected Products

@fastify/static versions up to and including 10.1.0
Fastify applications relying on route-scoped middleware to gate access to files under the static root
Node.js services depending on the send library's normalization behavior for path-traversal protection

Discovery Timeline

2026-07-23 - CVE CVE-2026-15074 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15074

Vulnerability Analysis

The vulnerability affects how @fastify/static processes request pathnames before delegating file resolution to the underlying send library. The plugin does not reject dot-dot segments early in the request lifecycle. Route-scoped middleware executes against the raw URL path, so a request such as /protected/../public/secret.txt matches route guards for the /public/ prefix rather than the guarded /protected/ prefix.

When send receives the pathname, it normalizes dot segments before applying its own traversal guard. Normalization collapses .. sequences and resolves the request to a file inside the static root that belongs to the guarded prefix. The traversal guard in send only prevents escape outside the static root, so it allows the resolved path. The result is a route-guard bypass that exposes files inside the configured static root.

Root Cause

The root cause is missing input validation. @fastify/static does not normalize or reject dot-dot segments before route matching. The earlier fix for CVE-2026-6414 addressed only encoded forward slashes and left unencoded .. segments in place. Trust for path sanitization was implicitly delegated to send, which normalizes after route dispatch has already occurred.

Attack Vector

An attacker sends an unauthenticated HTTP request whose pathname begins with an unguarded prefix and traverses via .. into a guarded prefix inside the same static root. Because Fastify matches route middleware against the pre-normalized URL, guard middleware attached to the guarded prefix never executes. The vulnerability does not permit access outside the configured static root. It defeats route-scoped filtering only, exposing confidentiality of files that the operator intended to gate behind authentication or authorization checks.

A representative request pattern is GET /unprotected/../admin/config.json HTTP/1.1, where the target file resides beneath a route prefix protected by an onRequest or preHandler hook.

Detection Methods for CVE-2026-15074

Indicators of Compromise

HTTP access logs containing .. segments in request URIs directed at endpoints served by @fastify/static
Successful 200 OK responses to requests that combine an unguarded route prefix with .. traversal into a guarded prefix
Retrieval of files under guarded prefixes without an accompanying authentication event in application logs

Detection Strategies

Inventory Node.js services and identify installations of @fastify/static at version 10.1.0 or earlier using package manifests and lockfiles
Alert on HTTP requests containing raw .. segments reaching Fastify services, especially where multiple static route prefixes share a common root
Correlate static-file responses under protected URL prefixes with the absence of preceding authorization decisions in application telemetry

Monitoring Recommendations

Forward Fastify access logs and application authorization events to a central analytics platform for correlation and retention
Add web application firewall or reverse proxy rules that normalize URLs before reaching Fastify and flag traversal attempts
Track dependency drift for @fastify/static across build pipelines and production runtimes to identify unpatched instances

How to Mitigate CVE-2026-15074

Immediate Actions Required

Upgrade @fastify/static to version 10.1.1 or later across all Fastify services
Audit route configurations that combine multiple static prefixes under a single static root and validate which files are reachable via traversal
Review recent access logs for requests containing .. segments targeting guarded prefixes and investigate any successful responses

Patch Information

The issue is fixed in @fastify/static10.1.1. Refer to the GitHub Security Advisory GHSA-83w8-p2f5-377r and the OpenJS Foundation Security Advisories for authoritative details.

Workarounds

Place a reverse proxy or WAF in front of Fastify that normalizes URLs and rejects requests containing .. segments before they reach the application
Restructure static directories so that guarded and unguarded content do not share a common static root, eliminating the traversal target
Move authorization checks from route-scoped middleware to file-level checks that execute after path normalization

bash

# Upgrade example using npm
npm install @fastify/static@^10.1.1

# Verify installed version
npm ls @fastify/static