@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static decodes percent-encoded path separators (%2F) before it resolves files from disk, while Fastify's router treats those same bytes as literal characters when matching route guards. That mismatch — classic CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize) — means a route-level preHandler or auth middleware guarding /admin/* will not match a request to /admin%2Fsecret.json, but the static plugin will happily serve admin/secret.json from the wwwroot. Affected versions track with the sibling advisory GHSA-x428-ghpx-8j92 pattern: @fastify/static up to and including 9.1.0, fixed in 9.1.1. Only applications that (a) mount @fastify/static and (b) rely on Fastify's own routing layer to enforce authorization on static assets are exposed — apps that use a reverse-proxy ACL or a filesystem-level ACL are not.

The vendor tag of MEDIUM / 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N) is defensible. The bug leaks confidentiality only — no write, no execution, no crash — and only for files the deployer chose to place inside the static root but wanted gated behind Fastify middleware. That is a real bug, but it's a narrow one; the majority of @fastify/static deployments serve fully public assets (bundled JS, CSS, images), in which case there is nothing to bypass. Vendor severity matches reality.

Why this verdict

• Impact ceiling is C:L. No RCE, no write, no crash. Even successful exploitation only reads files the deployer chose to place inside a Fastify-served directory. That is a ceiling the CVSS math cannot pierce.
• Prerequisite audit narrows the population sharply. The chain requires: (1) app uses @fastify/static, AND (2) app relies on Fastify router-level middleware for authz on that static subtree, AND (3) no upstream proxy normalizes %2F. Every mainstream CDN/WAF (Cloudflare, Akamai, Fastly, AWS ALB w/ normalization) breaks step 2. Realistic exposed population is a fraction of a percent of @fastify/static installs.
• Role multiplier: none. @fastify/static is an application-tier library, not identity/hypervisor/PKI/backup/kernel-agent. There is no realistic deployment where compromising it yields DA, hypervisor escape, or supply-chain pivot. The deployment-role floor does NOT apply — nothing pushes this above MEDIUM.
• No KEV, no observed exploitation, low EPSS. The threat pressure is theoretical. Compare with the parent CVE-2026-6414 which has been public longer and still has no reported ITW use.

Why not higher?

HIGH would require either an integrity/availability impact or a role-multiplier compromise (identity, hypervisor, admin plane). Neither is present: the CVSS impact vector is C:L/I:N/A:N and @fastify/static is not a high-value-role component. Even if every deployment were exploitable tomorrow, the worst outcome is disclosure of a single file per request from a directory the developer already chose to serve.

Why not lower?

LOW/IGNORE would be wrong because the bug is unauthenticated, network-reachable, and trivial to weaponize (curl --path-as-is). Any team that put a config or backup JSON in a gated static tree is one request away from disclosure. That's a real bug that deserves a scheduled patch, not a wontfix.

1. Upgrade @fastify/static to >= 9.1.1 — The only real fix. Bump the pin in package.json, run npm ci, rebuild the image, redeploy. Because this is a MEDIUM verdict, there is no noisgate mitigation SLA — schedule the upgrade inside the 365-day remediation window, but bring it forward if you know you have gated static content.
2. Reject encoded path separators at the edge — On NGINX add if ($request_uri ~* "%2[fF]") { return 400; }; on Cloudflare enable the Managed Rule for encoded-slash normalization; on AWS ALB use a WAF rule. Buys you time until the upgrade lands — deploy today if you cannot upgrade this week.
3. Move sensitive files out of the static root — If a file needs auth, serve it from a route handler that pulls from a directory outside root. This removes the vulnerability class entirely, not just this CVE. Do it as part of the next sprint regardless.
4. Convert route-scoped preHandler guards to global onRequest hooks — Global hooks run before route matching, so they see the raw (still-encoded) path and can normalize it themselves. Cheaper than an architectural refactor for teams that cannot upgrade immediately.

Run on an auditor workstation or CI job that can reach the target Fastify host. Invoke as ./check-cve-2026-7120.sh https://target.example.com /admin/known-file.json. No privileges required. Exits 1 (VULNERABLE), 0 (PATCHED), 2 (UNKNOWN).

#!/usr/bin/env bash
# noisgate: CVE-2026-7120 @fastify/static route-guard bypass check
# Usage: ./check-cve-2026-7120.sh <base_url> <gated_path>
#   e.g. ./check-cve-2026-7120.sh https://app.example.com /admin/config.json
set -u

BASE="${1:-}"
GATED="${2:-}"

if [[ -z "$BASE" || -z "$GATED" ]]; then
  echo "UNKNOWN: usage: $0 <base_url> <gated_path>" >&2
  exit 2
fi

# Split gated path into prefix and file
PREFIX="$(dirname "$GATED")"
FILE="$(basename "$GATED")"
ENCODED_PATH="${PREFIX}%2F${FILE}"

echo "[*] Baseline: GET ${BASE}${GATED}"
BASELINE=$(curl -sk -o /dev/null -w '%{http_code}' "${BASE}${GATED}")
echo "    -> HTTP ${BASELINE}"

echo "[*] Attack:   GET ${BASE}${ENCODED_PATH}"
ATTACK=$(curl -sk --path-as-is -o /dev/null -w '%{http_code}' "${BASE}${ENCODED_PATH}")
echo "    -> HTTP ${ATTACK}"

# Baseline must be a block (401/403/404) AND attack must be a success (200)
if [[ "$BASELINE" =~ ^(401|403|404)$ ]] && [[ "$ATTACK" == "200" ]]; then
  echo "VULNERABLE: guard returned ${BASELINE} but encoded-separator returned 200"
  exit 1
fi

if [[ "$BASELINE" == "$ATTACK" ]]; then
  echo "PATCHED: guard behavior consistent across canonical and encoded paths (${BASELINE})"
  exit 0
fi

echo "UNKNOWN: baseline=${BASELINE} attack=${ATTACK} — inspect manually"
exit 2

Sources

1. GHSA-x428-ghpx-8j92 — sibling advisory in @fastify/static
2. GitHub Advisory DB — CVE-2026-6414 (same class)
3. SentinelOne — CVE-2026-6414 writeup
4. Snyk — Directory Traversal in @fastify/static
5. GitLab Advisory DB — @fastify/static CVE-2026-6414
6. Fastify security advisories index
7. CWE-180 — Incorrect Behavior Order: Validate Before Canonicalize
8. FIRST EPSS API — CVE-2026-7120