Medium 5.9Published Apr 16, 2026

CVE-2026-6414@fastify/static vulnerable to route guard bypass via encoded path separators

Updated under an hour ago (Oct 27, 2026, 6:10 AM ET)

Does this affect you?

It affects @fastify/static and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for @fastify/static

Exploited in the last 30 days

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.

CVSS: 5.9 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-177
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: openjs
NVD analysis: Analyzed
Record last updated: Apr 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

@fastify/static @fastify/static fastify_static:fastify_static (from the name)	from 8.0.0 before 9.1.1; 9.1.1 not affected	CNA record
fastify fastify-static fastify:fastify-static	from 8.0.0 before 9.1.1	NVD

References

References

https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p	not-applicable
https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr	not-applicable
https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92	vendor-advisory
https://cna.openjsf.org/security-advisories.html	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.