CVE-2026-90982: @fastify/static vulnerable to route guard bypass via path case-folding

DescriptionCVE.org

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler, yet the filesystem resolves it to the same protected file. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization. As a workaround, serve static files from a case-sensitive filesystem, or ensure route guards and allowedPath rules account for every letter-case variant of the protected paths.

• @fastify/static · @fastify/staticbefore 10.1.4

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Improper Handling of Case Sensitivity · Input Validation and Logic

Vendor

@fastify/static

Published

September 2026

Band

Unlikely (under 1%), September 2026

• NVD entrynvd.nist.gov
• CVE recordcve.org
• Weakness CWE-178cwe.mitre.org
• github.com/fastify/fastify-static/security/advisories/GHSA-r799-github.com
• cna.openjsf.org/security-advisories.htmlcna.openjsf.org