@fastify/static Schwachstellen (CVE)

Für @fastify/static veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

6 Ergebnisse

5.3Mittel

CVE-2026-90982 vor 1 Monat

@fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static @fastify/static

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by…

7.5Hoch

CVE-2026-18427 vor 3 Monaten

@fastify/static vulnerable to route guard bypass via non-canonical path segments

@fastify/static @fastify/static

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes befo…

7.5Hoch

CVE-2026-15074 vor 3 Monaten

@fastify/static vulnerable to route guard bypass via path traversal

@fastify/static @fastify/static

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the unde…

5.3Mittel

CVE-2026-7120 vor 3 Monaten

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static @fastify/static

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath res…

5.3Mittel

CVE-2026-6410 vor 7 Monaten

@fastify/static vulnerable to path traversal in directory listing

@fastify/static @fastify/static

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remot…

5.9Mittel

CVE-2026-6414 vor 7 Monaten

@fastify/static vulnerable to route guard bypass via encoded path separators

@fastify/static @fastify/static

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that pr…