Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-06T14:52:26 @fastify/static: @fastify/static: Information disclosure via route guard bypass 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-41

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.

A flaw was found in @fastify/static. An unauthenticated attacker can bypass route-based guards by using non-canonical path segments in a request. This allows the attacker to access and disclose the contents of files that should be protected by these guards. The vulnerability stems from the static file handler's failure to properly canonicalize various path forms, such as dot segments, duplicate slashes, encoded dots, or backslashes, before matching routes and serving files.

This is an Important information disclosure flaw in @fastify/static that allows an unauthenticated attacker to bypass route guards. By crafting a non-canonical path, an attacker can access files intended to be protected, leading to sensitive information disclosure. Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Dev Spaces Not affected devspaces/dashboard-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-18427 https://nvd.nist.gov/vuln/detail/CVE-2026-18427 https://cna.openjsf.org/security-advisories.html https://github.com/fastify/fastify-static/security/advisories/GHSA-423g-23ch-w7c6