@fastify/static, versions up to 10.1.0, does not reject dot-dot path segments before the file‑resolution stage, allowing an attacker to bypass route‑scoped middleware and disclose files located under the static root. The flaw is a repetition of a previously fixed path‑traversal issue, but the current bug also affects unencoded "../" segments. The underlying send library normalizes dot segments before applying its own guard, which means the request reaches the router with a path that can be interpreted relative to the static directory, leading to unintended file disclosure. This weakness is documented as CWE‑22 – Path Traversal.

The issue impacts the @fastify/static package used in Node.js web applications. All releases through 10.1.0 are affected; the vulnerability was addressed in version 10.1.1. No other vendors or products are listed.

The CVSS score of 7.5 reflects significant confidentiality impact, while the EPSS < 1% indicates a low but nonzero likelihood of exploitation in the wild. The vulnerability is not present in CISA’s KEV catalog. An unauthenticated attacker can craft a request with "../" segments to traverse within the static root, bypassing route guards that rely on path normalization. Because the flaw does not let the attacker escape the configured root, the damage is limited to files already exposed through the static service, but sensitive application resources could still be revealed.