The vulnerability in @fastify/static between versions 8.0.0 and 9.1.0 involves the plugin decoding percent‑encoded path separators (%2F) before resolving the file system path, while the Fastify router treats the encoded sequence as a literal slash. This inconsistency lets an attacker craft a URL that bypasses route‑based middleware or guards placed around static asset routes. The attack does not provide code execution but can expose files that should be protected. Based on the description, it is inferred that access to otherwise restricted static content may be gained. The weakness is related to CWE‑177 (Path Traversal) and CWE‑76 (Improper Handling of Encoded Input).

Node.js applications that use @fastify/static (catalogued as @fastify/static) are affected in all releases from 8.0.0 through 9.1.0. The vulnerability also applies to frameworks that employ the forked version of @fastify/static, such as Hono.

The CVSS score of 5.9 denotes moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The ability to bypass route guards depends on receiving an HTTP request containing percent‑encoded slash characters; this request is trivial to construct. Based on the description, it is inferred that bypassing the guard may reveal confidential files, potentially resulting in data disclosure. No remote code execution is provided, but the exposure of sensitive assets could have significant business impact.