CVE-2026-90982 @fastify/static CVE debrief

Who should care

Defenders responsible for systems using @fastify/static to serve static files from case-insensitive filesystems, especially those on Windows or macOS, should assess exposure and prioritize patching or workarounds.

Why it matters

CVE-2026-90982 allows bypassing route guards in @fastify/static on case-insensitive filesystems, potentially leading to unauthorized file reading. Defenders should verify exposure, prioritize patching or workarounds, and review route guard configurations.

• Potential unauthorized reading of protected static files
• Bypassing of route guards and allowedPath restrictions on case-insensitive filesystems
• Verification of filesystem and route guard configuration required
• Patching or workarounds necessary to prevent exploitation

Technical summary

The @fastify/static plugin for Fastify serves static files from a configured root directory. In versions before 10.1.4, a route guard or allowedPath restriction can be bypassed on case-insensitive filesystems by altering the case of a path segment. This allows an unauthenticated request to read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization.

Defensive priority

Defenders should prioritize verifying and applying the patch to @fastify/static versions before 10.1.4, especially for systems serving static files from case-insensitive filesystems.

Recommended defensive actions

• Verify and apply the patch to @fastify/static versions before 10.1.4
• Serve static files from a case-sensitive filesystem if possible
• Review and update route guards and allowedPath rules to account for case variants of protected paths
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The issue arises from a case sensitivity mismatch between route guards and case-insensitive filesystems like those on Windows or the default macOS volume. An unauthenticated request can bypass route guards or allowedPath restrictions by altering the case of a path segment, potentially reading protected files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.