CVE-2026-7120: @fastify/static Auth Bypass Vulnerability

CVE-2026-7120 Overview

CVE-2026-7120 affects @fastify/static, a static file serving plugin for the Fastify Node.js web framework. The vulnerability exists because the plugin evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the request pathname. An unauthenticated remote attacker can bypass path-based access filtering by requesting non-canonical but equivalent pathnames. Versions up to and including 10.1.1 are affected, and the issue is patched in version 10.1.2.

Critical Impact
An unauthenticated attacker can bypass allowedPath restrictions and access files intended to be denied. The bypass defeats path-based filtering only and does not permit access outside the configured static root.

Affected Products

@fastify/static versions up to and including 10.1.1
Node.js applications using Fastify with static file serving and custom allowedPath filters
Applications relying on path-based access control through @fastify/static

Discovery Timeline

2026-07-23 - CVE-2026-7120 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-7120

Vulnerability Analysis

The vulnerability stems from the order of operations in request handling within @fastify/static. The plugin invokes the developer-supplied allowedPath callback against the raw incoming pathname. Normalization of dot segments such as .. and ., along with collapsing of duplicate path separators, occurs afterward during file resolution.

Because the check evaluates a different string than the one used to resolve the file, attackers can craft equivalent non-canonical pathnames that fail to match deny rules yet still resolve to the target file. The weakness maps to [CWE-180]: Incorrect Behavior Order: Validate Before Canonicalize. Impact is limited to confidentiality since only file read access to files already inside the configured static root is affected.

Root Cause

The plugin performs path filtering before canonicalization. The allowedPath callback receives the untransformed request path, while the underlying file resolver later normalizes the path for filesystem lookup. This mismatch between the validated string and the resolved string breaks the security assumption that a rejected path cannot map to a served file.

Attack Vector

An unauthenticated remote attacker sends HTTP requests containing non-canonical path representations. Techniques include inserting duplicate slashes such as // between directory segments, embedding no-op . segments, or combining .. sequences that resolve back to the intended file after normalization. Each variant passes the allowedPath check because its literal string does not match the denied canonical path. The file resolver then normalizes the request and serves the denied file.

No exploit code is required beyond crafting the URL. The vulnerability is exploitable at network scope with low complexity and no privileges or user interaction. See the GitHub Security Advisory GHSA-8pvw-jcv7-9cmj for additional technical detail.

Detection Methods for CVE-2026-7120

Indicators of Compromise

HTTP request logs containing pathnames with duplicate separators such as //, embedded /./ segments, or .. sequences targeting paths served by @fastify/static.
Successful 200 OK responses for files that the application's allowedPath policy is documented to deny.
Access patterns where a client first probes a denied path, then retries with variant encodings of the same resource.

Detection Strategies

Inventory Node.js applications and identify installations of @fastify/static at version 10.1.1 or earlier using npm ls @fastify/static or software composition analysis tooling.
Compare raw request paths against normalized paths in access logs to surface requests whose canonical form differs from the URL as received.
Alert on requests whose pathname contains //, /./, or /../ sequences against endpoints backed by @fastify/static.

Monitoring Recommendations

Enable verbose access logging on Fastify servers and forward logs to a centralized analytics platform for path-normalization anomaly analysis.
Add rules in web application firewalls to flag non-canonical request paths targeting static asset routes.
Correlate repeated denied-then-allowed access sequences for the same underlying file to identify probing behavior.

How to Mitigate CVE-2026-7120

Immediate Actions Required

Upgrade @fastify/static to version 10.1.2 or later across all affected Node.js applications.
Audit application code for use of allowedPath callbacks and verify assumptions about the pathname format supplied to the callback.
Review recent access logs for suspicious non-canonical requests against paths intended to be denied.

Patch Information

The issue is patched in @fastify/static version 10.1.2. The fix ensures pathname normalization occurs before the allowedPath callback is evaluated, so the callback sees the same canonical path used for file resolution. Refer to the OpenJSF Security Advisories and the GitHub Security Advisory GHSA-8pvw-jcv7-9cmj for release details.

Workarounds

If immediate upgrade is not possible, normalize the request pathname inside the allowedPath callback before performing string comparisons or pattern matching.
Place a reverse proxy in front of the Fastify application configured to reject or canonicalize requests containing .., duplicate slashes, or /./ segments.
Move sensitive files out of the static root entirely rather than relying on allowedPath filtering.

bash

# Upgrade @fastify/static to the patched release
npm install @fastify/static@10.1.2

# Verify the installed version
npm ls @fastify/static