{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/@fastify/static/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-15074"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@fastify/static"],"_cs_severities":["high"],"_cs_tags":["fastify","nodejs","web-vulnerability","path-traversal","webserver"],"_cs_type":"advisory","_cs_vendors":["Fastify"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@fastify/static\u003c/code\u003e package, specifically versions up to 10.1.0, is susceptible to a route guard bypass vulnerability, tracked as CVE-2026-15074. This vulnerability enables attackers to bypass route-based middleware and access protected files served by the static plugin. The core issue lies in how the \u003ccode\u003efind-my-way\u003c/code\u003e router processes path segments, failing to normalize \u003ccode\u003e..\u003c/code\u003e or \u003ccode\u003e%2E%2E\u003c/code\u003e before matching routes. A previous fix for \u003ccode\u003eGHSA-x428-ghpx-8j92\u003c/code\u003e only addressed \u003ccode\u003e%2F\u003c/code\u003e variants, leaving these other path traversal sequences unhandled. Consequently, these sequences survive \u003ccode\u003edecodeURI\u003c/code\u003e and \u003ccode\u003eencodeURI\u003c/code\u003e operations, only to be collapsed later by \u003ccode\u003e@fastify/send\u003c/code\u003e's \u003ccode\u003epath.normalize\u003c/code\u003e function, thereby circumventing initial security guards. This allows unauthorized access to sensitive files or directories intended to be protected by application-level routing.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts an HTTP GET request targeting a \u003ccode\u003efastify/static\u003c/code\u003e endpoint that serves files. The request path includes a crafted sequence like \u003ccode\u003e/foo/../deep/secret.txt\u003c/code\u003e or \u003ccode\u003e/foo/%2E%2E/deep/secret.txt\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request reaches the \u003ccode\u003efind-my-way\u003c/code\u003e router which is used by Fastify. Due to its inability to normalize \u003ccode\u003e..\u003c/code\u003e or \u003ccode\u003e%2E%2E\u003c/code\u003e segments before route matching, the crafted path bypasses specific, guarded routes (e.g., \u003ccode\u003e/deep/*\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe request instead matches the static plugin's broader catch-all route, allowing the request to proceed despite the intended route guard.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetPathnameForSend\u003c/code\u003e helper, intended to prevent path traversal, processes the URI. However, it only adequately guards against \u003ccode\u003e%2F\u003c/code\u003e variants, allowing \u003ccode\u003e..\u003c/code\u003e and \u003ccode\u003e%2E%2E\u003c/code\u003e segments to remain in the path after \u003ccode\u003edecodeURI\u003c/code\u003e and \u003ccode\u003eencodeURI\u003c/code\u003e round-trips.\u003c/li\u003e\n\u003cli\u003eThe request is then passed to \u003ccode\u003e@fastify/send\u003c/code\u003e, which internally uses \u003ccode\u003epath.normalize\u003c/code\u003e. This function collapses the \u003ccode\u003e..\u003c/code\u003e or \u003ccode\u003e%2E%2E\u003c/code\u003e segments, effectively resolving the path to \u003ccode\u003edeep/secret.txt\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efastify/static\u003c/code\u003e plugin, now operating under the collapsed and normalized path, serves the \u003ccode\u003esecret.txt\u003c/code\u003e file from the \u003ccode\u003e/deep/\u003c/code\u003e directory, which was intended to be protected by route-based middleware.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully gains unauthorized access to the protected \u003ccode\u003esecret.txt\u003c/code\u003e file, circumventing the application's security controls.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-15074 leads to unauthorized access to files or directories that are otherwise protected by an application's route-based middleware or guards. This can result in sensitive information disclosure, including configuration files, source code, or proprietary data, which could further enable attackers to escalate privileges, gain persistence, or exfiltrate critical business assets. Any application relying on \u003ccode\u003e@fastify/static\u003c/code\u003e for serving static content with route-based access controls is at risk, potentially exposing a wide range of assets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@fastify/static\u003c/code\u003e to version 10.1.1 or higher immediately to patch CVE-2026-15074.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not feasible, implement the workaround: avoid relying on route-based middleware or guards to protect files served by \u003ccode\u003e@fastify/static\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to your SIEM to detect attempts at exploiting this path traversal vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T16:52:27Z","date_published":"2026-07-24T16:52:27Z","id":"https://feed.craftedsignal.io/briefs/2026-07-fastify-static-path-traversal-bypass/","summary":"The @fastify/static package is vulnerable to a route guard bypass via path traversal using non-leading '..' or '%2E%2E' path segments, allowing attackers to circumvent route-based middleware and access protected files that are served by the static plugin.","title":"Fastify/static Vulnerable to Route Guard Bypass via Path Traversal","url":"https://feed.craftedsignal.io/briefs/2026-07-fastify-static-path-traversal-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - @Fastify/Static","version":"https://jsonfeed.org/version/1.1"}