build(deps): update dependency @fastify/static to v10 [security] by renovate[bot] · Pull Request #628 · wmfs/tymly-fastify-plugin

renovate · 2026-04-17T00:39:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
@fastify/static	`8.2.0` → `10.1.2`

@fastify/static vulnerable to route guard bypass via encoded path separators

CVE-2026-6414 / GHSA-x428-ghpx-8j92

More information

Details

Impact

@fastify/static v9.1.0 and earlier decodes percent-encoded path separators (%2F) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/* do not match /admin%2Fsecret.html, but @fastify/static decodes it to /admin/secret.html and serves the file.

Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

None. Upgrade to the patched version.

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@fastify/static vulnerable to path traversal in directory listing

CVE-2026-6410 / GHSA-pr96-94w5-mx2h

More information

Details

Impact

@fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path() to resolve a directory outside the root via path.join() without a containment check.

A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

Disable directory listing by removing the list option from the plugin configuration.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

CVE-2026-7120 / GHSA-8pvw-jcv7-9cmj

More information

Details

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@fastify/static vulnerable to route guard bypass via path traversal

CVE-2026-15074 / GHSA-83w8-p2f5-377r

More information

Details

Impact

@fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded /deep/*. The getPathnameForSend helper introduced by the fix for GHSA-x428-ghpx-8j92 only guards against the %2F variant; .. and %2E%2E survive the decodeURI + encodeURI round-trip and are then collapsed away by @fastify/send's path.normalize before its own traversal guard runs.

Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with non-leading dot-dot path segments.

Patches

Upgrade to @fastify/static 10.1.1.

Workarounds

Do not use route-based middlewares or guards to protect files served by @fastify/static.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

fastify/fastify-static (@fastify/static)

`v10.1.2`

Compare Source

⚠️ Security Release

Fix for GHSA-8pvw-jcv7-9cmj

What's Changed

ci: pin actions to commit-hash by @Fdawgs in #601

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

`v10.1.1`

Compare Source

⚠️ Security Release

Fix for GHSA-83w8-p2f5-377r

What's Changed

docs(readme): fix typos by @Fdawgs in #600

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

`v10.1.0`

Compare Source

What's Changed

fix: set Vary: Accept-Encoding for preCompressed responses by @LeSingh1 in #586
feat: use @fastify/error for errors and add option suppressWarning by @climba03003 in #599

New Contributors

@LeSingh1 made their first contribution in #586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

`v10.0.0`

Compare Source

Breaking Changes

setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers.
For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@&#8203;fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(res) {
    res.setHeader('X-Test', 'Foo')
  }
})
// After
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@&#8203;fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(reply) {
    reply.header('X-Test', 'Foo')
  }
})

What's Changed

chore!: bump content-disposition fom 1.0.1 to 2.0.1 by @climba03003 in #597
fix: ignore unsupported deflate for precompressed assets by @jibin7jose in #596
fix!: allow setHeaders to override send headers by @climba03003 in #598

New Contributors

@jibin7jose made their first contribution in #596

Full Changelog: fastify/fastify-static@v9.3.0...v10.0.0

`v9.3.0`

Compare Source

What's Changed

chore: update fastify-plugin dependency to version 6.0.0 by @Puppo in #594

New Contributors

@Puppo made their first contribution in #594

Full Changelog: fastify/fastify-static@v9.2.0...v9.3.0

`v9.2.0`

Compare Source

What's Changed

chore(.gitattributes): retain binary file eol style by @Fdawgs in #577
refactor(types): migrate from tsd to tstyche by @Tony133 in #579
fix: propagate return value from fastify.errorHandler by @abdulmunimjemal in #582
chore: update depedabot setting by @climba03003 in #583
chore: bump @fastify/compress from 8.3.1 to 9.0.0 by @dependabot[bot] in #590
chore: bump @types/node from 25.9.4 to 26.0.0 in the dev-dependencies-typescript group by @dependabot[bot] in #592
docs: fix broken links by @Fdawgs in #591
docs: clarify precompressed allowedPath behavior by @mcollina in #593

New Contributors

@abdulmunimjemal made their first contribution in #582

Full Changelog: fastify/fastify-static@v9.1.3...v9.2.0

`v9.1.3`

Compare Source

What's Changed

fix: support wildcard prefixes with route params by @mcollina in #576

Full Changelog: fastify/fastify-static@v9.1.2...v9.1.3

`v9.1.2`

Compare Source

What's Changed

fix: resolve wildcard paths in encapsulated contexts by @mcollina in #574

Full Changelog: fastify/fastify-static@v9.1.1...v9.1.2

`v9.1.1`

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-6410 GHSA-pr96-94w5-mx2h.
This fixes CVE CVE-2026-6414 GHSA-x428-ghpx-8j92.

What's Changed

ci: add lock-threads workflow by @Fdawgs in #570

Full Changelog: fastify/fastify-static@v9.1.0...v9.1.1

`v9.1.0`

Compare Source

What's Changed

build(deps-dev): bump @types/node from 24.10.4 to 25.0.3 by @dependabot[bot] in #552
test: move ignoreTrailingSlash under routerOptions by @lraveri in #553
build(deps-dev): bump borp from 0.20.2 to 0.21.0 by @dependabot[bot] in #543
chore: bump pino and borp dependencies, delete stale.yml by @Tony133 in #557
chore: update syntax typescript by @Tony133 in #558
chore(license): standardise license notice by @Fdawgs in #560
fix: sendFile ignoring option overrides in some cases by @bakugo in #559
chore: upgrade c8 to v11.0.0 and improvements test by @Tony133 in #564
build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in #566

New Contributors

@lraveri made their first contribution in #553
@Tony133 made their first contribution in #557
@bakugo made their first contribution in #559

Full Changelog: fastify/fastify-static@v9.0.0...v9.1.0

`v9.0.0`

Compare Source

What's Changed

build(deps): bump content-disposition from 0.5.4 to 1.0.1 by @dependabot[bot] in #547
Update glob@13 by @mcollina in #550

Full Changelog: fastify/fastify-static@v8.3.0...v9.0.0

`v8.3.0`

Compare Source

What's Changed

docs: use cross-platform compatible info emoji by @Fdawgs in #522
docs: fix typo by @9w in #523
chore(license): update date ranges; standardise style by @Fdawgs in #525
chore: remove reference to simple-get by @ilteoood in #528
build(deps-dev): bump @types/node from 22.15.34 to 24.0.8 by @dependabot[bot] in #527
test(types): add missing anchors by @Fdawgs in #529
docs(readme): correct compatibility table by @Fdawgs in #531
refactor: remove usage of deprecated request.routeConfig by @inyourtime in #530
build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in #532
chore(.npmrc): ignore scripts by @Fdawgs in #533
build(deps-dev): remove @fastify/pre-commit by @Fdawgs in #534
chore(index): add jsdoc comments for static code analysis by @Fdawgs in #535
chore: Replace substr with slice for URL manipulation by @Uzlopak in #538
refactor: small improvements by @ilteoood in #539
fix: if serve: false and root is not defined, only allow sending files with absolute path by @Uzlopak in #540
ci(ci): add concurrency config by @Fdawgs in #541

New Contributors

@9w made their first contribution in #523
@inyourtime made their first contribution in #530

Full Changelog: fastify/fastify-static@v8.2.0...v8.3.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov · 2026-04-17T00:40:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.06%. Comparing base (1351342) to head (dfdec86).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #628   +/-   ##
=======================================
  Coverage   81.06%   81.06%           
=======================================
  Files          19       19           
  Lines         301      301           
=======================================
  Hits          244      244           
  Misses         57       57

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

renovate Bot added the security Pull requests that address a security vulnerability label Apr 17, 2026

renovate Bot requested a review from a team April 17, 2026 00:39

renovate Bot changed the title ~~build(deps): update dependency @fastify/static to v9 [security]~~ build(deps): update dependency @fastify/static to v9 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot deleted the renovate/npm-fastify-static-vulnerability branch April 27, 2026 16:46

renovate Bot changed the title ~~build(deps): update dependency @fastify/static to v9 [security] - autoclosed~~ build(deps): update dependency @fastify/static to v9 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-fastify-static-vulnerability branch 2 times, most recently from 5dae8cf to 59c08c6 Compare April 27, 2026 20:09

build(deps): update dependency @fastify/static to v10 [security]

dfdec86

renovate Bot force-pushed the renovate/npm-fastify-static-vulnerability branch from 59c08c6 to dfdec86 Compare July 28, 2026 18:36

renovate Bot changed the title ~~build(deps): update dependency @fastify/static to v9 [security]~~ build(deps): update dependency @fastify/static to v10 [security] Jul 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): update dependency @fastify/static to v10 [security] - #628

build(deps): update dependency @fastify/static to v10 [security]#628
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-fastify-static-vulnerability

renovate Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​fastify/static vulnerable to route guard bypass via encoded path separators

Details

Impact

Patches

Workarounds

Severity

References

@​fastify/static vulnerable to path traversal in directory listing

Details

Impact

Patches

Workarounds

Severity

References

@​fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Details

Impact

Patches

Workarounds

Severity

References

@​fastify/static vulnerable to route guard bypass via path traversal

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

⚠️ Security Release

What's Changed

⚠️ Security Release

What's Changed

What's Changed

New Contributors

Breaking Changes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

⚠️ Security Release

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

codecov Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 17, 2026 •

edited

Loading

@fastify/static vulnerable to route guard bypass via encoded path separators

@fastify/static vulnerable to path traversal in directory listing

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static vulnerable to route guard bypass via path traversal

codecov Bot commented Apr 17, 2026 •

edited

Loading