@fastify/static vulnerabilities
We track 2 vulnerabilities in @fastify/static products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 6, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest @fastify/static vulnerabilities
- 7.5 High severity
@fastify/static: Improper Limitation of a Pathname to a Restricted Directory
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes befor
- 7.5 High severity
@fastify/static: Improper Limitation of a Pathname to a Restricted Directory
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the under