Fastify Fastify-Static
7 CVEs affecting Fastify Fastify-Static. Latest disclosed: 2026-08-06. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22964 | High | 8.8 | 2021-10-14 | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary web… |
CVE-2026-18427 | High | 7.5 | 2026-08-06 | @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segm… |
CVE-2026-15074 | High | 7.5 | 2026-07-23 | @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypas… |
CVE-2021-22963 | Medium | 6.1 | 2021-10-14 | A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a double slash // fol… |
CVE-2026-6414 | Medium | 5.9 | 2026-04-16 | @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as l… |
CVE-2026-7120 | Medium | 5.3 | 2026-07-23 | @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Vers… |
CVE-2026-6410 | Medium | 5.3 | 2026-04-16 | @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves d… |