fix(deps): update dependency @fastify/static to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@fastify/static	^9.0.0 → ^10.0.0

---

@​fastify/static vulnerable to route guard bypass via encoded path separators

CVE-2026-6414 / GHSA-x428-ghpx-8j92

More information

Details

Impact

@fastify/static v9.1.0 and earlier decodes percent-encoded path separators (%2F) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/* do not match /admin%2Fsecret.html, but @​fastify/static decodes it to /admin/secret.html and serves the file.

Applications that rely on route-based middleware or guards to protect files served by @​fastify/static can be bypassed with encoded path separators.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

None. Upgrade to the patched version.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92
• https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p
• https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr
• https://nvd.nist.gov/vuln/detail/CVE-2026-6414
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-x428-ghpx-8j92

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​fastify/static vulnerable to path traversal in directory listing

CVE-2026-6410 / GHSA-pr96-94w5-mx2h

More information

Details

Impact

@fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path() to resolve a directory outside the root via path.join() without a containment check.

A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

Disable directory listing by removing the list option from the plugin configuration.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2h
• https://nvd.nist.gov/vuln/detail/CVE-2026-6410
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-pr96-94w5-mx2h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

CVE-2026-7120 / GHSA-8pvw-jcv7-9cmj

More information

Details

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-7120
• https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/releases/tag/v10.1.2
• https://github.com/advisories/GHSA-8pvw-jcv7-9cmj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​fastify/static vulnerable to route guard bypass via path traversal

CVE-2026-15074 / GHSA-83w8-p2f5-377r

More information

Details

Impact

@fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded /deep/*. The getPathnameForSend helper introduced by the fix for GHSA-x428-ghpx-8j92 only guards against the %2F variant; .. and %2E%2E survive the decodeURI + encodeURI round-trip and are then collapsed away by @fastify/send's path.normalize before its own traversal guard runs.

Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with non-leading dot-dot path segments.

Patches

Upgrade to @fastify/static 10.1.1.

Workarounds

Do not use route-based middlewares or guards to protect files served by @fastify/static.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r
• https://nvd.nist.gov/vuln/detail/CVE-2026-15074
• https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/releases/tag/v10.1.1
• https://github.com/advisories/GHSA-83w8-p2f5-377r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​fastify/static vulnerable to route guard bypass via path traversal

CVE-2026-15074 / GHSA-83w8-p2f5-377r

More information

Details

Impact

@fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded /deep/*. The getPathnameForSend helper introduced by the fix for GHSA-x428-ghpx-8j92 only guards against the %2F variant; .. and %2E%2E survive the decodeURI + encodeURI round-trip and are then collapsed away by @fastify/send's path.normalize before its own traversal guard runs.

Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with non-leading dot-dot path segments.

Patches

Upgrade to @fastify/static 10.1.1.

Workarounds

Do not use route-based middlewares or guards to protect files served by @fastify/static.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r
• https://nvd.nist.gov/vuln/detail/CVE-2026-15074
• https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static
• https://github.com/fastify/fastify-static/releases/tag/v10.1.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

@​fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

CVE-2026-7120 / GHSA-8pvw-jcv7-9cmj

More information

Details

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-7120
• https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static
• https://github.com/fastify/fastify-static/releases/tag/v10.1.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify-static (@​fastify/static)

v10.1.2

Compare Source

⚠️ Security Release

• Fix for GHSA-8pvw-jcv7-9cmj

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in #​601

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

Compare Source

⚠️ Security Release

• Fix for GHSA-83w8-p2f5-377r

What's Changed

• docs(readme): fix typos by @​Fdawgs in #​600

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

Compare Source

What's Changed

• fix: set Vary: Accept-Encoding for preCompressed responses by @​LeSingh1 in #​586
• feat: use @fastify/error for errors and add option suppressWarning by @​climba03003 in #​599

New Contributors

• @​LeSingh1 made their first contribution in #​586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Compare Source

Breaking Changes

• setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers.
For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(res) {
    res.setHeader('X-Test', 'Foo')
  }
})
// After
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(reply) {
    reply.header('X-Test', 'Foo')
  }
})

What's Changed

• chore!: bump content-disposition fom 1.0.1 to 2.0.1 by @​climba03003 in #​597
• fix: ignore unsupported deflate for precompressed assets by @​jibin7jose in #​596
• fix!: allow setHeaders to override send headers by @​climba03003 in #​598

New Contributors

• @​jibin7jose made their first contribution in #​596

Full Changelog: fastify/fastify-static@v9.3.0...v10.0.0

v9.3.0

Compare Source

What's Changed

• chore: update fastify-plugin dependency to version 6.0.0 by @​Puppo in #​594

New Contributors

• @​Puppo made their first contribution in #​594

Full Changelog: fastify/fastify-static@v9.2.0...v9.3.0

v9.2.0

Compare Source

What's Changed

• chore(.gitattributes): retain binary file eol style by @​Fdawgs in #​577
• refactor(types): migrate from tsd to tstyche by @​Tony133 in #​579
• fix: propagate return value from fastify.errorHandler by @​abdulmunimjemal in #​582
• chore: update depedabot setting by @​climba03003 in #​583
• chore: bump @​fastify/compress from 8.3.1 to 9.0.0 by @​dependabot[bot] in #​590
• chore: bump @​types/node from 25.9.4 to 26.0.0 in the dev-dependencies-typescript group by @​dependabot[bot] in #​592
• docs: fix broken links by @​Fdawgs in #​591
• docs: clarify precompressed allowedPath behavior by @​mcollina in #​593

New Contributors

• @​abdulmunimjemal made their first contribution in #​582

Full Changelog: fastify/fastify-static@v9.1.3...v9.2.0

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.