Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical pathnames, causing files that were intended to be denied to be served anyway. The bypass does not allow access outside the configured static root by itself, it defeats path-based filtering only. The issue is patched in @fastify/static 10.1.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 Medium-severity security fix in @fastify/static@10.1.2 just released! Patches CVE-2026-7120: @fastify/static vulnerable to authorization bypass via non-canonical URL paths. https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj
Post summary
A new patch has been released for @fastify/[email protected] that addresses CVE-2026-7120, an authorization bypass vulnerability exploiting non‑canonical URL paths.
CVE-2026-7120 Path Traversal Bypass in @fastify/static Versions Up to 10.1.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7120
Post summary
CVE‑2026‑7120 is identified as a path traversal bypass in @fastify/static up to version 10.1.1, but no exploit code, PoC, or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastify | fastify-static | - | - | - |