CVE-2026-15074 @fastify/static CVE debrief

Who should care

Users of @fastify/static version 10.1.0 or earlier should update to version 10.1.1 or later as soon as possible. This vulnerability has a HIGH CVSS score of 7.5, indicating a significant risk to affected systems. Affected operators, platforms, and security teams should review the vulnerability and take necessary actions to mitigate the risk. Vulnerability management and security teams should prioritize the update and ensure that affected systems are properly mitigated.

Technical summary

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1. Affected systems should be updated to version 10.1.1 of @fastify/static as soon as possible.

Defensive priority

High-priority defensive actions are recommended due to the HIGH CVSS score of 7.5. Affected systems should be updated to version 10.1.1 of @fastify/static as soon as possible.

Recommended defensive actions

• Update @fastify/static to version 10.1.1 or later
• Review and update affected systems
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the NVD and CVE.org indicates that @fastify/static up to and including version 10.1.0 is vulnerable to a path traversal attack. The issue is patched in version 10.1.1. Further review of the source code and affected systems is recommended to ensure that the vulnerability is properly mitigated. Defenders should verify that their systems are updated to version 10.1.1 or later and monitor for potential exploitation attempts.

Official resources