@fastify/static vulnerable to route guard bypass via path traversal

@fastify/static percent-decodes path separators (%2F) *before* handing the resolved path to the filesystem, while Fastify's core router matches the raw, still-encoded URL. That mismatch means a request like /admin%2Fsecret.html sails past any preHandler/onRequest guard bound to /admin/* — the router sees a single opaque path segment — but the static plugin cheerfully decodes it and serves admin/secret.html from disk. Affected versions are 8.0.0 through 9.1.0; the fix landed in 9.1.1. Root cause is CWE-177 (improper URL-encoding handling), not classic ../ traversal — you cannot escape the served root, you can only reach files *inside* it that middleware was supposed to gate.

The vendor CVSS in the intel block (7.5, AV:N/AC:L/PR:N/UI:N/C:H) is out of sync with the GitHub Security Advisory, which scores this 5.9 with AC:H because the exploit requires a very specific app topology: route-based auth in front of a @fastify/static mount whose served directory contains files the guard was meant to protect. That is a real but narrow pattern. Confidentiality-only impact, no integrity or availability effect. Treat this as MEDIUM unless you have telemetry proving the vulnerable pattern is in your stack.

Why this verdict

• Vendor score reconciliation: the 7.5 AV:N/AC:L in the intel block conflicts with the GHSA's 5.9 AC:H. AC:H is defensible because the exploit demands a specific app shape (guard + static mount + sensitive files in served dir). Adopt 5.9 as the baseline.
• Friction — reverse proxy normalization: most production Node apps sit behind nginx, Cloudflare, AWS ALB, or a similar edge that normalizes %2F to / before origin, which restores the router match and neutralizes the bypass. This alone eliminates a large share of the theoretically-vulnerable population.
• Friction — application pattern rarity: the vulnerable pattern (route-guard-protected static mount over a directory containing genuinely sensitive files) is uncommon; most fastify shops mount static at /public with no guard, or serve gated content through DB-backed handlers, not the filesystem.
• Role multiplier — low-value role (LOB web app): chain succeeds; blast radius = read a subset of files from one static mount. No privilege gain, no lateral movement. Confidentiality only.
• Role multiplier — typical role (customer-facing SaaS tier): chain succeeds; blast radius = tenant-scoped file exposure if the static mount is per-tenant. Still confidentiality-only, still single-app.
• Role multiplier — high-value role (identity provider / CI / backup / hypervisor): @fastify/static is not the identity, secrets, or orchestration plane. There is no realistic high-value-role deployment where this plugin's blast radius escalates to fleet, domain, or supply-chain compromise. No role floor applies — the HIGH/CRITICAL floor from the deployment-role rule is not triggered.
• Impact ceiling: vector explicitly says I:N/A:N. No write, no RCE, no DoS. Confidentiality alone with a narrow file set caps this at MEDIUM.

Why not higher?

HIGH would require either fleet-scale blast radius (this bug reads files from one mount on one app), an identity/trust role multiplier (fastify-static is not in that catalog), or active exploitation/KEV listing (neither present). AC:H plus proxy normalization plus rare vulnerable pattern make HIGH indefensible.

Why not lower?

LOW would ignore that when the vulnerable pattern *does* exist — guarded admin static mount serving real secrets — the bypass is a single curl with no auth. It is a real access-control failure with confirmed PoC and a clean vendor patch, so it deserves a scheduled remediation, not backlog hygiene.

1. Upgrade @fastify/static to 9.1.1+ — The only complete fix. npm ls @fastify/static across your monorepos and CI images, bump direct dependencies, and let renovate/dependabot carry transitive bumps. Deploy within the noisgate remediation window (365 days for MEDIUM) — but if you have a confirmed vulnerable pattern, treat it as urgent and ship this sprint.
2. Reject %2F (and %5C on Windows) in URL paths at the edge — Add a WAF/nginx rule: if ($request_uri ~* "%2[fF]") { return 400; } or the Cloudflare/AWS WAF equivalent. This kills the bypass regardless of the plugin version. Since there is no mitigation SLA at MEDIUM, deploy opportunistically alongside your next WAF ruleset push, but this is cheap enough to do now.
3. Move sensitive files out of any @fastify/static root — Serve gated content through an explicit handler that runs the auth check in code (fastify.get('/admin/secret.html', {preHandler: auth}, ...)), not through filesystem static. This is defense-in-depth and fixes the whole class of routing/serving mismatches, not just this CVE.
4. Enable path normalization on all fronting proxies — Confirm nginx merge_slashes on;, Cloudflare 'Normalize URLs to origin' setting, and AWS ALB path-normalization behavior are on. Any of these individually neutralizes the exploit for traffic that traverses them.

Run on any host with Node.js and network access to the target app, or point it at a checked-out repo. Usage: ./check.sh https://app.example.com /admin (probes for the live bypass) or ./check.sh --package ./package-lock.json (SCA check). No privileges required.

#!/usr/bin/env bash
# noisgate verifier for CVE-2026-6414 (@fastify/static route guard bypass)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

usage() { echo "usage: $0 <base_url> <guarded_prefix>   |   $0 --package <path/to/package-lock.json>" >&2; exit 2; }
[ $# -lt 2 ] && usage

if [ "$1" = "--package" ]; then
  LOCK="$2"
  [ ! -f "$LOCK" ] && { echo "UNKNOWN: lockfile not found"; exit 2; }
  VER=$(grep -Eo '"@fastify/static"[^}]*"version": "[0-9]+\.[0-9]+\.[0-9]+"' "$LOCK" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | sort -uV | tail -1)
  if [ -z "$VER" ]; then echo "PATCHED: @fastify/static not present in $LOCK"; exit 0; fi
  # semver compare: vulnerable if >=8.0.0 and <=9.1.0
  MIN="8.0.0"; MAX="9.1.0"
  lowest=$(printf '%s\n%s\n' "$VER" "$MIN" | sort -V | head -1)
  highest=$(printf '%s\n%s\n' "$VER" "$MAX" | sort -V | tail -1)
  if [ "$lowest" = "$MIN" ] && [ "$highest" = "$MAX" ]; then
    echo "VULNERABLE: @fastify/static $VER is in range >=8.0.0,<=9.1.0"; exit 1
  else
    echo "PATCHED: @fastify/static $VER is outside vulnerable range"; exit 0
  fi
fi

BASE="${1%/}"
PREFIX="${2#/}"; PREFIX="${PREFIX%/}"
PROBE="probe-$(date +%s).html"

# Baseline: guarded path should be 401/403/404
BLOCKED=$(curl -sk -o /dev/null -w '%{http_code}' "$BASE/$PREFIX/$PROBE")
# Bypass attempt: %2F between prefix and file
BYPASS=$(curl -sk -o /dev/null -w '%{http_code}' "$BASE/${PREFIX}%2F$PROBE")

echo "guarded response: $BLOCKED    bypass response: $BYPASS"

if [ "$BLOCKED" != "200" ] && [ "$BYPASS" = "200" ]; then
  echo "VULNERABLE: route guard bypassed via %2F"; exit 1
fi
if [ "$BLOCKED" = "$BYPASS" ]; then
  echo "PATCHED: guard behavior identical for encoded and decoded separator"; exit 0
fi
echo "UNKNOWN: inconclusive — run against a known-guarded, known-existing static file"; exit 2

Sources

1. GitHub Security Advisory GHSA-x428-ghpx-8j92
2. GitHub Advisory Database CVE-2026-6414
3. GitLab Advisory Database CVE-2026-6414
4. SentinelOne vulnerability DB CVE-2026-6414
5. Related: @fastify/static directory listing traversal (GHSA-pr96-94w5-mx2h)
6. Snyk: Directory Traversal in @fastify/static (CVE-2026-6410)
7. fastify-static security overview
8. CWE-177: Improper Handling of URL Encoding