CVE-2026-7120 @fastify/static CVE debrief

Who should care

Developers and administrators using @fastify/static versions up to and including 10.1.1 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and adjusting path-based filtering configurations and monitoring for potential exploitation attempts. Affected operators, platforms, and security teams should prioritize this vulnerability based on its CVSS score and potential impact on their systems and data. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions should be tracked, and remediated assets retested and closed only after evidence is documented. Asset inventory and source tracking can help in managing this vulnerability effectively across the organization. Rollback and change windows should be considered for updates or mitigations through normal change control where exposure is confirmed. The bypass does not allow access outside the configured static root by itself; it defeats path-based filtering only. Evidence from the NVD and CVE.org indicates that @fastify/static versions up to and including 10.1.1 are affected by a path traversal issue. The CVE record and NVD detail provide information on the vulnerability and its impact. Defensive priority is medium due to the CVSS score of 5.3 and potential for bypassing path-based filtering in @fastify/static. Evidence limits and known affected scope should be considered when verifying this vulnerability. Defenders should verify configurations and implement compensating controls where necessary. The vulnerability allows for bypassing path-based filtering, which can lead to unintended file serving. This can be mitigated by updating to version 10.1.2 or later and reviewing path-based filtering configurations. Monitoring and detection capabilities should be reviewed to ensure they can identify potential exploitation attempts. Asset inventory and source tracking can help in managing this vulnerability effectively across the organization. Rollback and change windows should be considered for updates or mitigations through normal .

Technical summary

The @fastify/static module evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. This allows an unauthenticated attacker to bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, potentially causing files that were intended to be denied to be served anyway. The issue is patched in @fastify/static 10.1.2. Affected product context and defensive impact should be considered when assessing this vulnerability.

Defensive priority

Medium-priority defensive actions are recommended due to the CVSS score of 5.3 and the potential for bypassing path-based filtering in @fastify/static.

Recommended defensive actions

• Update @fastify/static to version 10.1.2 or later
• Review and adjust path-based filtering configurations
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from the NVD and CVE.org indicates that @fastify/static versions up to and including 10.1.1 are affected by a path traversal issue. The CVE record and NVD detail provide information on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.