CVE-2026-6414: falha de média gravidade em @fastify/static
@fastify/static vulnerable to route guard bypass via encoded path separators
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.4%
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
@fastify/static · @fastify/staticCVEs relacionadas — @fastify/static
No mesmo produto, das mais perigosas para as menos.
CVE-2026-15074HIGH@fastify/static vulnerable to route guard bypass via path traversalEPSS 0.7%CVE-2026-18427HIGH@fastify/static vulnerable to route guard bypass via non-canonical path segmentsEPSS 0.7%CVE-2026-90982MEDIUM@fastify/static vulnerable to route guard bypass via path case-foldingEPSS 0.6%CVE-2026-6410MEDIUM@fastify/static vulnerable to path traversal in directory listingEPSS 0.5%CVE-2026-7120MEDIUM@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL PathsEPSS 0.4%