Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90982— @fastify/static vulnerable to route guard bypass via path case-folding

Quick assessment

Affected
@fastify/static @fastify/static
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个 Fastify 插件，用于从配置的根目录提供静态文件服务。在 10.1.4 之前的版本中，在大小写不敏感的文件系统（如 Windows 或 macOS 的默认卷）上，通过更改路径片段的大小写，可以绕过路由守卫（route guard）或 allowedPath 限制。由于路由匹配器是大小写敏感的，而文件系统是大小写不敏感的，因此更改受保护片段大小写的请求不会匹配到受守卫的路由，从而“落”到静态文件处理器，但文件系统仍会将其解析为同一个受保护文件。结果是，未认证的请求能够读取本应由路由守卫或 allowedP

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1079
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90982

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/static vulnerable to route guard bypass via path case-folding
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler, yet the filesystem resolves it to the same protected file. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization. As a workaround, serve static files from a case-sensitive filesystem, or ensure route guards and allowedPath rules account for every letter-case variant of the protected paths.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/static @fastify/static 0 ~ 10.1.4 -

II. Public POCs for CVE-2026-90982

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90982

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-90982 (1)

IV. Related Vulnerabilities

Same product: @fastify/static
Same vendor: @fastify/static
Same weakness: CWE-178

V. Comments for CVE-2026-90982

No comments yet

Leave a comment