A newly disclosed Fastify static file vulnerability, tracked as CVE-2026-7120, is a reminder that even tiny details in path handling can punch big holes in otherwise well-secured Node.js apps. If you’re using the @fastify/static plugin, this is one you can’t ignore.
What CVE-2026-7120 Actually Does
The CVE-2026-7120 vulnerability affects the @fastify/static plugin up to and including version 10.1.1. The bug stems from how the plugin evaluates its allowedPath callback when deciding whether a requested file should be served.
In affected versions, @fastify/static calls the allowedPath function before it normalizes dot segments and duplicate path separators in the incoming pathname. That ordering matters. It creates an opening where an attacker can disguise a path using alternate but equivalent forms that slip past access checks and ultimately resolve to restricted files.
In practical terms, an unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-canonical paths that the callback thinks are safe, but the file resolver later maps to a sensitive location.
Why This Is a Big Deal for Fastify Static Users
Fastify is widely used in the Node.js ecosystem to build high-performance APIs and web apps. The @fastify/static plugin is the go-to solution in that ecosystem for serving static assets like images, stylesheets, and downloads directly from the file system.
Many teams lean on allowedPath to tighten things down: limiting access to certain directories, exposing only specific files, or implementing custom business rules for what can and cannot be served. CVE-2026-7120 essentially undercuts that trust model.
If your configuration assumes that allowedPath is a reliable last line of defense, a crafty attacker could turn your static server into a file-leaking liability. Because the vulnerability can be exploited without authentication, any internet-exposed endpoint using @fastify/static in a vulnerable configuration is a potential target.
How Path Normalization Opens the Door
Path traversal bugs are almost always about discrepancies: one part of a system thinks a path is one thing, another part treats it as something else. Here, the order of operations creates exactly that split-brain situation.
Static file serving typically involves steps like:
- Receiving a raw URL path from the client.
- Checking whether the path is allowed.
- Normalizing the path (collapsing
.., removing duplicates, cleaning separators). - Mapping it to a file on disk.
CVE-2026-7120 flips the safe order. By calling allowedPath before canonicalizing the incoming path, @fastify/static gives attackers room to play tricks with how the path looks during validation versus how it ultimately resolves on disk.
That’s where “equivalent non-canonical paths” come into play. An attacker isn’t trying to invent a brand-new path; they’re sending alternate spellings of the same location that pass validation but resolve somewhere they shouldn’t.
Who Is Impacted by CVE-2026-7120
Any application using @fastify/static up to and including version 10.1.1 is potentially affected by CVE-2026-7120. The risk is particularly serious if you:
- Expose the static endpoint to the public internet.
- Rely on
allowedPathto restrict access to certain directories or files. - Host files adjacent to sensitive content (logs, config backups, internal docs) within the same file tree.
Because the vulnerability is reachable without authentication, the usual login or API token protections don’t help much here. If an attacker can hit your static routes directly, they can at least attempt to exploit the mis-ordering of checks and normalization.
On the flip side, apps that do not use allowedPath or that serve only truly public, non-sensitive assets from a segregated directory structure are at lower risk from CVE-2026-7120. The bug specifically undermines trust in the path-allowlisting mechanism.
Mitigation: What Fastify Devs Should Do Now
The most important mitigation for CVE-2026-7120 is straightforward: update @fastify/static to a version that fixes the ordering of normalization and allowedPath evaluation. Versions beyond 10.1.1 are expected to handle canonicalization before invoking any path checks, which closes this particular loophole.
Until you can update, there are defensive steps you can take:
- Harden your directory layout: Serve static files from a dedicated directory that contains only public assets, with no sensitive files anywhere in the tree.
- Use an upstream proxy: Put a reverse proxy (like Nginx or a CDN) in front of your Node.js app and configure it to normalize paths and strip suspicious patterns before requests reach Fastify.
- Log aggressively: Turn on detailed request logging for static routes so you can spot odd-looking paths and repeated attempts at traversal-style attacks.
None of these are a substitute for patching @fastify/static, but they can reduce the window of exposure while you roll out an update.
What Security Teams Should Be Monitoring
Security teams and SREs responsible for Node.js infrastructure should add CVE-2026-7120 to their tracking lists and treat it as a priority issue, especially in environments with a large number of Fastify services.
Key actions include:
- Inventorying all services that use @fastify/static and identifying versions at or below 10.1.1.
- Flagging instances where
allowedPathis used to gate access to anything remotely sensitive. - Scanning logs for anomalous static file requests featuring odd dot-segment usage or duplicated separators.
The vulnerability is relatively narrow in scope—focused on how the plugin hands off paths to the callback—but the blast radius can be wide if misconfigured static servers sit next to confidential data.
What This Means
CVE-2026-7120 is a classic example of how small sequencing mistakes in path handling can create real-world security issues in web frameworks. For Fastify developers and Node.js shops using @fastify/static, it’s a nudge to upgrade quickly and to rethink how much you trust application-level path filters to protect sensitive files.
If your app depends on allowedPath as a guardrail, treat this as a necessary course correction: patch the plugin, isolate your static assets, and let path normalization happen before any security decisions are made. Static file serving may feel like plumbing, but when that plumbing leaks, attackers are more than happy to drink from it.
