This vulnerability arises from an incomplete route guard in the @fastify/static library that fails to canonicalize file paths before matching routes. An attacker can supply path segments such as dot segments, duplicate slashes, backslashes, or encoded dots to reach a file that is otherwise protected by a route-based guard. The flaw allows unauthenticated remote access to sensitive files, exposing their contents without authentication, violating confidentiality, and potentially enabling further attacks.

All installations of @fastify/static earlier than version 10.1.3 that protect a subtree of the static root with a route-based guard are affected. Applications that rely on the allowedPath option are not impacted. The affected environments are Node.js web applications using Fastify’s static file plugin.

The CVSS score is 7.5, indicating high severity. The EPSS score is not available, suggesting no publicly known exploitation data; the vulnerability is not listed in CISA’s KEV catalog. The attack vector is a remote HTTP request to a non-canonical file path, requiring no special privileges on the server. While exploitation is likely possible, the lack of active exploits and the need for a precise path configuration imply a moderate risk of exploitation in the wild.