| Package | Affected versions | Patched versions |
|---|---|---|
| fastify-static | < 10.1.2 | 10.1.2 |
| @fastify/static | < 10.1.2 | 10.1.2 |
@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.
Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.
Upgrade to @fastify/static >= 10.1.2.
None. Upgrade to the patched version.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free