CVE-2026-6414 @fastify/static vulnerable to route guard bypass via encoded path separators

What is CVE-2026-6414?

CVE-2026-6414 is a medium-severity vulnerability in @fastify/static, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.

Weakness: CWE-177

Which versions are affected by CVE-2026-6414?

2 open source packages ship an affected version, including @fastify/static. It affects 1 product.

Products include Fastify Fastify-Static.

How do I fix CVE-2026-6414?

Upgrade @fastify/static to 9.1.1 or later.

Is CVE-2026-6414 being exploited?

There is no known exploitation of CVE-2026-6414 in the wild and no public exploit code.

Other vulnerabilities in @fastify/static

• CVE-2021-22964 DOS and Open Redirect with user input High 8.8
• CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments High 7.5
• CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal High 7.5
• CVE-2021-22963 URL Redirection to Untrusted Site ('Open Redirect') in fastify-static Medium 6.1
• CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x428-ghpx-8j92, MINI-r7q9-h4q3-pgj5.