Detections
Analytics

SCA: security update for @fastify/static (GHSA-83w8-p2f5-377r)

high Tenable Self-Hosted Container Security Plugin ID 445273

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request
 pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which
 only covered encoded forward slashes. Because the underlying send library normalizes dot segments before
 applying its own path-traversal guard, an unauthenticated attacker can bypass any route-scoped middleware
 and read files inside the static root that live under the guarded URL prefix. The bypass does not allow
 access outside the configured static root by itself, it defeats route-guard filtering only. The issue is
 patched in @fastify/static 10.1.1. (CVE-2026-15074)

Solution

Update the @fastify/static library and its related packages to version 10.1.1 or later.

See Also

https://github.com/advisories/GHSA-83w8-p2f5-377r

Plugin Details

Severity: High

ID: 445273

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 7/24/2026

Updated: 7/24/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.76

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-15074

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/24/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-15074

cwe: CWE-22