CVE-2026-7120

Summary

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Severity

medium

CVSS

5.3

EPSS

0.4% (p31)

CWE

CWE-180

Also known as

GHSA-8pvw-jcv7-9cmj

Published

2026-07-24

Updated

2026-07-24

Advisory details

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.

References

• https://github.com/advisories/GHSA-8pvw-jcv7-9cmj
• https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-7120
• https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/releases/tag/v10.1.2

Related advisories

• CVE-2026-15074 — high · npm/@fastify/static
• CVE-2026-6410 — medium · npm/@fastify/static
• CVE-2026-6414 — medium · npm/@fastify/static
• GHSA-7rqj-j65f-68wh#next-auth — critical · npm/next-auth
• GHSA-7rqj-j65f-68wh#@auth/core — critical · npm/@auth/core
• CVE-2026-100409 — high · npm/@opennextjs/cloudflare
• CVE-2026-69246 — high · Packagist/guzzlehttp/guzzle
• CVE-2026-110306 — medium · npm/fast-uri

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity