CVE-2026-6414

Published: Apr 16, 2026Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: ce714d77-add3-4f53-aff5-83d477b104bb (Secondary)

Description

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.

Affected (1)

Products: Fastify: Fastify Static

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fastify Fastify Static	From 8.0.0 to 9.1.1

Related CWEs

Improper Handling of URL Encoding (Hex Encoding)

The product does not properly handle when all or part of an input has been URL encoded.

References (4)

https://cna.openjsf.org/security-advisories.html

Source: ce714d77-add3-4f53-aff5-83d477b104bb

Third Party Advisory

https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92

Source: ce714d77-add3-4f53-aff5-83d477b104bb

Vendor Advisory

https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p

Source: ce714d77-add3-4f53-aff5-83d477b104bb

Not Applicable

https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr

Source: ce714d77-add3-4f53-aff5-83d477b104bb

Not Applicable

Timeline

No history available yet.