5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6414

CVE-2026-6414: @fastify/static vulnerable to route guard bypass via encoded path separators

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6414

CVE-2026-6414:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@fastify/static	npm	>= 8.0.0, <= 9.1.0	9.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-x428-ghpx-8j92, in @fastify/static allows for a route guard bypass using percent-encoded path separators. An analysis of the patch correcting this issue, specifically commit cc7b7f7e00a5f028599ba17392b831afd0c651aa, reveals the root cause. The flaw was in the wildcard route handler within the fastifyStatic function in index.js. The vulnerable code used req.params['*'] to determine the file path. This string, containing the encoded characters, was passed to the send library which then decoded it, turning %2F into /. This allowed access to files that should have been protected. The fix involves using the raw URL (req.raw.url) and a new parsing function (getPathnameForSend) to safely construct the path, preventing the unintended decoding of path separators and ensuring such requests are properly rejected.

Vulnerable functions

fastifyStatic

index.js

The vulnerability is located in an anonymous handler function within the main `fastifyStatic` function. This handler processes wildcard routes to serve static files. In the vulnerable version, it constructs the file path using `req.params['*']`. This value is then passed to the `send` library which decodes percent-encoded characters, including path separators like `%2F`. This allows an attacker to bypass route-based security guards by crafting a URL with an encoded separator. The router will not match the guard, but the static plugin will decode the path and serve the protected file.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.