GHSA-x428-ghpx-8j92
Medium · 5.9CVSS
5.9
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
@fastify/static vulnerable to route guard bypass via encoded path separators
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/static | 8.0.0 | 9.1.1 |
Related vulnerabilities
- CVE-2026-6414 @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F)… Same vulnerability
- GHSA-pr96-94w5-mx2h @fastify/static vulnerable to path traversal in directory listing Also affects @fastify/static
- CVE-2026-6410 @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing… Also affects @fastify/static
- CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host… CWE-177
- CVE-2026-76172 fast-uri is a URI parser for Node.js. CWE-177
- CVE-2026-41041 URL path injection via unencoded user-supplied identifiers vulnerability in Apache… CWE-177
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-177
- GHSA-q5qw-h33p-qvwr Hono vulnerable to arbitrary file access via serveStatic vulnerability CWE-177