CVE-2026-18427 @fastify/static CVE debrief

Who should care

Developers and administrators using @fastify/static in applications with route-based guards protecting static file subtrees should review and apply the patch in version 10.1.3. Affected operators, platforms, vulnerability-management, and security teams should prioritize defensive review due to the high CVSS score of 7.5 and potential for unauthenticated attackers to disclose protected file contents. Security teams should also verify and update affected applications, monitor for suspicious activity, and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, asset inventory and change management processes should be reviewed to ensure that affected systems are properly tracked and updated. Those responsible for incident response and threat hunting should be aware of potential exploitation attempts and have detection and response plans in place. IT operations teams should also be prepared to apply patches or mitigations through normal change control processes where exposure is confirmed. Finally, developers should review the code changes in version 10.1.3 to understand the fix and ensure that similar vulnerabilities are addressed in the future. Those managing third-party dependencies should verify that @fastify/static is up-to-date and consider implementing additional security measures to protect against potential attacks. Lastly, security awareness training should be considered for developers and administrators to ensure they understand the risks associated with this vulnerability and the importance of applying patches promptly. The CVE record was published on 2026-08-06T16:16:38.350Z and has not been modified since then. The NVD entry is currently Received. The fix in version 10.1.3 canonicalizes the pathname and rejects backslashes on the path used for routing and serving. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. Developers and administrators should review and apply the patch in version 10.1.3. They should also verify and update affected applications using @fastify/static, monitor for and restrict

Technical summary

The @fastify/static module before version 10.1.3 contains an incomplete fix for a previous route guard bypass vulnerability. The static file handler did not properly canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and serving. This allows an unauthenticated attacker to request a file protected by a route-based guard using a non-canonical path form, potentially disclosing its contents. Applications protecting a subtree of the static root with a route-based guard are affected, while those relying on the allowedPath option are not.

Defensive priority

High-priority defensive review recommended due to high CVSS score of 7.5 and potential for unauthenticated attackers to disclose protected file contents.

Recommended defensive actions

• Review and apply the patch in @fastify/static version 10.1.3
• Verify and update affected applications using @fastify/static
• Monitor for and restrict non-canonical path requests to protected routes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The official CVE record and NVD entry indicate an incomplete fix in @fastify/static before version 10.1.3 for a previous route guard bypass. The fix in version 10.1.3 canonicalizes the pathname and rejects backslashes on the path used for routing and serving. Evidence from official sources suggests that applications protecting a subtree of the static root with a route-based guard are affected, while those relying on the allowedPath option are not. Defenders should verify and update affected applications using @fastify/static, monitor for and restrict non-canonical path requests to protected routes, and review compensating controls for exposed systems.

Official resources