CVE-2026-90982: medium-severity vulnerability in @fastify/static
@fastify/static vulnerable to route guard bypass via path case-folding
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler, yet the filesystem resolves it to the same protected file. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization. As a workaround, serve static files from a case-sensitive filesystem, or ensure route guards and allowedPath rules account for every letter-case variant of the protected paths.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
@fastify/static · @fastify/staticRelated CVEs — @fastify/static
In the same product, most dangerous first.
CVE-2026-15074HIGH@fastify/static vulnerable to route guard bypass via path traversalEPSS 0.7%CVE-2026-18427HIGH@fastify/static vulnerable to route guard bypass via non-canonical path segmentsEPSS 0.7%CVE-2026-6410MEDIUM@fastify/static vulnerable to path traversal in directory listingEPSS 0.5%CVE-2026-6414MEDIUM@fastify/static vulnerable to route guard bypass via encoded path separatorsEPSS 0.4%CVE-2026-7120MEDIUM@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL PathsEPSS 0.4%