Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware and read files inside the static root that live under the guarded URL prefix. The bypass does not allow access outside the configured static root by itself, it defeats route-guard filtering only. The issue is patched in @fastify/static 10.1.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 High-severity security fix in @fastify/static@10.1.1 just released! Patches CVE-2026-15074: @fastify/static vulnerable to route guard bypass via path traversal. https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r
Post summary
A high‑severity patch has been released for @fastify/[email protected] to fix CVE-2026-15074, a path traversal bug that bypasses route guards.
🚨High - @fastify/static Route-Guard Bypass via Dot-Dot Path Segments (CVE-2026-15074) @fastify/static (up to 10.1.0) fails to reject dot-dot (..) path segments before the file-resolution stage. Because the underlying send library normalizes dot segments before applying its own traversal guard, an unauthenticated attacker can bypass route-scoped middleware and read files inside the static root that sit under a guarded URL prefix. This is a bypass of the earlier CVE-2026-6414 fix, which only handled encoded forward slashes. It does not allow access outside the static root by itself - it defeats route-guard filtering only. CVSS 7.5, confidentiality impact. 👉Upgrade @fastify/static to 10.1.1.
Post summary
Fastify/static v10.1.0 allows an unauthenticated attacker to bypass route-guard using dot-dot path segments, exposing files within the static root; upgrading to v10.1.1 patches the issue.
CVE-2026-15074 Path Traversal Bypass in @fastify/static Up to Version 10.1.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15074
Post summary
The text announces CVE-2026-15074 as a path traversal bypass in fastify/static up to 10.1.0, without providing PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify-static | - | - | - |