CVE-2026-18427 in static
Summary
by MITRE • 08/06/2026
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route based guard using a non canonical path form that misses the guarded route yet resolves back onto the protected file, disclosing its contents. Applications that protect a subtree of the static root with a route based guard are affected, while applications relying on the allowedPath option are not. This is fixed in @fastify/static 10.1.3, which canonicalizes the pathname, including rejecting backslashes, on the path used for routing and serving.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability in @fastify/static versions prior to 10.1.3 represents a significant security flaw that undermines access control mechanisms through improper path canonicalization. This issue stems from an incomplete fix for a previous route guard bypass vulnerability where the static file handler only addressed parent directory traversal segments but failed to account for various forms of non-canonical path representations. The flaw allows attackers to exploit path manipulation techniques that bypass intended access controls by using encoded characters, duplicate slashes, and other path normalization variations that ultimately resolve to protected files.
The technical implementation of this vulnerability occurs at the path processing layer where the system performs route matching before canonicalizing file paths. When an attacker crafts a request using non-canonical path forms such as double slashes, encoded dots, or backslash characters, the system fails to properly normalize these paths before determining access permissions. This creates a scenario where a path that appears to be outside the protected route actually resolves to a file within the guarded subtree through path resolution mechanisms. The vulnerability specifically affects applications that rely on route-based guards for protecting static file subtrees rather than those using the allowedPath option which provides more robust access control.
From an operational impact perspective, this vulnerability enables unauthenticated attackers to bypass access controls and disclose sensitive files that should be protected by route guards. The flaw essentially creates a backdoor mechanism where attackers can traverse the file system through carefully crafted path sequences that exploit the incomplete canonicalization process. This represents a classic directory traversal vulnerability that has been exacerbated by the failure to implement proper path normalization before access control decisions are made, allowing attackers to discover and retrieve files they would normally be blocked from accessing.
The mitigation implemented in @fastify/static 10.1.3 addresses this issue through comprehensive path canonicalization that includes rejecting backslashes and properly normalizing all path components used for both routing and file serving operations. This fix ensures that all incoming paths are normalized before any access control decisions are made, preventing attackers from exploiting path manipulation techniques to bypass intended security controls. The solution aligns with established security best practices for path handling and follows the principle of least privilege by ensuring that only properly normalized paths are considered for access decisions. This vulnerability demonstrates the importance of proper input sanitization and canonicalization in web applications, particularly when dealing with file system operations and access control mechanisms.
This issue can be categorized under CWE-22 Path Traversal and aligns with ATT&CK technique T1083 File and Directory Discovery, representing a critical access control bypass that allows unauthorized information disclosure. The vulnerability highlights the importance of implementing robust path normalization at multiple layers within web application security architectures, particularly when dealing with static file serving components that must maintain strict access controls over protected content. Organizations using affected versions should immediately upgrade to 10.1.3 or later to ensure proper path canonicalization and prevent potential unauthorized access to sensitive files through crafted path manipulation attacks.