Vulnerability Description
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fastify | Fastify-Static | < 10.1.2 |
Related Weaknesses (CWE)
References
- https://cna.openjsf.org/security-advisories.htmlVendor Advisory
- https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmVendor Advisory
FAQ
What is CVE-2026-7120?
CVE-2026-7120 is a vulnerability with a CVSS score of 5.3 (MEDIUM). @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affec...
How severe is CVE-2026-7120?
CVE-2026-7120 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-7120?
Check the references section above for vendor advisories and patch information. Affected products include: Fastify Fastify-Static.