CVE-2026-7120

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cna.openjsf.org/security-advisories.html	Vendor Advisory
https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:*

History

28 Jul 2026, 17:05

Type	Values Removed	Values Added
CPE		cpe:2.3:a:fastify:fastify-static::::::::
First Time		Fastify Fastify fastify-static
References	~~() https://cna.openjsf.org/security-advisories.html -~~	() https://cna.openjsf.org/security-advisories.html - Vendor Advisory
References	~~() https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj -~~	() https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj - Vendor Advisory

23 Jul 2026, 04:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-23 04:16

Updated : 2026-07-28 17:05

NVD link : CVE-2026-7120

Mitre link : CVE-2026-7120

CVE.ORG link : CVE-2026-7120

JSON object : View

Products Affected

fastify

fastify-static

CWE

CWE-180

Incorrect Behavior Order: Validate Before Canonicalize

{"id": "CVE-2026-7120", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7120", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T14:15:15.256744Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "@fastify/static", "product": "@fastify/static", "versions": [{"status": "affected", "version": "0", "lessThan": "10.1.2", "versionType": "semver"}, {"status": "unaffected", "version": "10.1.2", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/static", "defaultStatus": "unaffected"}]}], "published": "2026-07-23T04:16:33.187", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-180"}]}], "descriptions": [{"lang": "en", "value": "@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2."}], "lastModified": "2026-07-28T17:05:24.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1051087A-0D7B-4AD9-B2C1-5F77CE5ECFD6", "versionEndExcluding": "10.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}