The vulnerability arises because @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. This ordering flaw allows an attacker to craft non-canonical pathnames that bypass the filtering logic. An unauthenticated user can request equivalent but non-canonical paths and cause files that were intended to be denied to be served. The bypass does not allow the attacker to access files outside the configured static root, but it defeats the intended path-based restrictions, potentially exposing sensitive content that was meant to remain hidden. This issue is classified as CWE-180, an authorization bypass weakness.

Users of the @fastify/static package version 10.1.1 or earlier are impacted. The issue was fixed in version 10.1.2, and later releases continue to contain the fix. No other vendor or product is known to be affected by this flaw.

The CVSS v3.1 score is 5.3, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be performed over an unauthenticated HTTP request to a server running the vulnerable plugin, and it relies only on path manipulation; no additional privileges or authentication are required. Consequently, the risk remains moderate, but remediation is still advised to prevent unintended file disclosure.