| Package | Affected versions | Patched versions |
|---|---|---|
| fastify-static | ≥ 8.0.0, < 9.1.1 | 9.1.1 |
| @fastify/static | ≥ 8.0.0, < 9.1.1 | 9.1.1 |
@fastify/static v9.1.0 and earlier decodes percent-encoded path separators (%2F) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/* do not match /admin%2Fsecret.html, but @fastify/static decodes it to /admin/secret.html and serves the file.
Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.
Upgrade to @fastify/static >= 9.1.1.
None. Upgrade to the patched version.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free