fix(deps): update dependency @fastify/static to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@fastify/static	^6.12.0 → ^10.0.0

---

@​fastify/static vulnerable to route guard bypass via path traversal

CVE-2026-15074 / GHSA-83w8-p2f5-377r

More information

Details

Impact

@fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded /deep/*. The getPathnameForSend helper introduced by the fix for GHSA-x428-ghpx-8j92 only guards against the %2F variant; .. and %2E%2E survive the decodeURI + encodeURI round-trip and are then collapsed away by @fastify/send's path.normalize before its own traversal guard runs.

Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with non-leading dot-dot path segments.

Patches

Upgrade to @fastify/static 10.1.1.

Workarounds

Do not use route-based middlewares or guards to protect files served by @fastify/static.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r
• https://nvd.nist.gov/vuln/detail/CVE-2026-15074
• https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/releases/tag/v10.1.1
• https://github.com/advisories/GHSA-83w8-p2f5-377r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

CVE-2026-7120 / GHSA-8pvw-jcv7-9cmj

More information

Details

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-7120
• https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/releases/tag/v10.1.2
• https://github.com/advisories/GHSA-8pvw-jcv7-9cmj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify-static (@​fastify/static)

v10.1.2

Compare Source

⚠️ Security Release

• Fix for GHSA-8pvw-jcv7-9cmj

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in #​601

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

Compare Source

⚠️ Security Release

• Fix for GHSA-83w8-p2f5-377r

What's Changed

• docs(readme): fix typos by @​Fdawgs in #​600

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

Compare Source

What's Changed

• fix: set Vary: Accept-Encoding for preCompressed responses by @​LeSingh1 in #​586
• feat: use @fastify/error for errors and add option suppressWarning by @​climba03003 in #​599

New Contributors

• @​LeSingh1 made their first contribution in #​586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Compare Source

Breaking Changes

• setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers.
For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@​fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(res) {
    res.setHeader('X-Test', 'Foo')
  }
})
// After
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@​fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(reply) {
    reply.header('X-Test', 'Foo')
  }
})

What's Changed

• chore!: bump content-disposition fom 1.0.1 to 2.0.1 by @​climba03003 in #​597
• fix: ignore unsupported deflate for precompressed assets by @​jibin7jose in #​596
• fix!: allow setHeaders to override send headers by @​climba03003 in #​598

New Contributors

• @​jibin7jose made their first contribution in #​596

Full Changelog: fastify/fastify-static@v9.3.0...v10.0.0

v9.3.0

Compare Source

What's Changed

• chore: update fastify-plugin dependency to version 6.0.0 by @​Puppo in #​594

New Contributors

• @​Puppo made their first contribution in #​594

Full Changelog: fastify/fastify-static@v9.2.0...v9.3.0

v9.2.0

Compare Source

What's Changed

• chore(.gitattributes): retain binary file eol style by @​Fdawgs in #​577
• refactor(types): migrate from tsd to tstyche by @​Tony133 in #​579
• fix: propagate return value from fastify.errorHandler by @​abdulmunimjemal in #​582
• chore: update depedabot setting by @​climba03003 in #​583
• chore: bump @​fastify/compress from 8.3.1 to 9.0.0 by @​dependabot[bot] in #​590
• chore: bump @​types/node from 25.9.4 to 26.0.0 in the dev-dependencies-typescript group by @​dependabot[bot] in #​592
• docs: fix broken links by @​Fdawgs in #​591
• docs: clarify precompressed allowedPath behavior by @​mcollina in #​593

New Contributors

• @​abdulmunimjemal made their first contribution in #​582

Full Changelog: fastify/fastify-static@v9.1.3...v9.2.0

v9.1.3

Compare Source

What's Changed

• fix: support wildcard prefixes with route params by @​mcollina in #​576

Full Changelog: fastify/fastify-static@v9.1.2...v9.1.3

v9.1.2

Compare Source

What's Changed

• fix: resolve wildcard paths in encapsulated contexts by @​mcollina in #​574

Full Changelog: fastify/fastify-static@v9.1.1...v9.1.2

v9.1.1

Compare Source

⚠️ Security Release

This fixes CVE CVE-2026-6410 GHSA-pr96-94w5-mx2h.
This fixes CVE CVE-2026-6414 GHSA-x428-ghpx-8j92.

What's Changed

• ci: add lock-threads workflow by @​Fdawgs in #​570

Full Changelog: fastify/fastify-static@v9.1.0...v9.1.1

v9.1.0

Compare Source

What's Changed

• build(deps-dev): bump @​types/node from 24.10.4 to 25.0.3 by @​dependabot[bot] in #​552
• test: move ignoreTrailingSlash under routerOptions by @​lraveri in #​553
• build(deps-dev): bump borp from 0.20.2 to 0.21.0 by @​dependabot[bot] in #​543
• chore: bump pino and borp dependencies, delete stale.yml by @​Tony133 in #​557
• chore: update syntax typescript by @​Tony133 in #​558
• chore(license): standardise license notice by @​Fdawgs in #​560
• fix: sendFile ignoring option overrides in some cases by @​bakugo in #​559
• chore: upgrade c8 to v11.0.0 and improvements test by @​Tony133 in #​564
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @​dependabot[bot] in #​566

New Contributors

• @​lraveri made their first contribution in #​553
• @​Tony133 made their first contribution in #​557
• @​bakugo made their first contribution in #​559

Full Changelog: fastify/fastify-static@v9.0.0...v9.1.0

v9.0.0

Compare Source

What's Changed

• build(deps): bump content-disposition from 0.5.4 to 1.0.1 by @​dependabot[bot] in #​547
• Update glob@​13 by @​mcollina in #​550

Full Changelog: fastify/fastify-static@v8.3.0...v9.0.0

v8.3.0

Compare Source

What's Changed

• docs: use cross-platform compatible info emoji by @​Fdawgs in #​522
• docs: fix typo by @​9w in #​523
• chore(license): update date ranges; standardise style by @​Fdawgs in #​525
• chore: remove reference to simple-get by @​ilteoood in #​528
• build(deps-dev): bump @​types/node from 22.15.34 to 24.0.8 by @​dependabot[bot] in #​527
• test(types): add missing anchors by @​Fdawgs in #​529
• docs(readme): correct compatibility table by @​Fdawgs in #​531
• refactor: remove usage of deprecated request.routeConfig by @​inyourtime in #​530
• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in #​532
• chore(.npmrc): ignore scripts by @​Fdawgs in #​533
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in #​534
• chore(index): add jsdoc comments for static code analysis by @​Fdawgs in #​535
• chore: Replace substr with slice for URL manipulation by @​Uzlopak in #​538
• refactor: small improvements by @​ilteoood in #​539
• fix: if serve: false and root is not defined, only allow sending files with absolute path by @​Uzlopak in #​540
• ci(ci): add concurrency config by @​Fdawgs in #​541

New Contributors

• @​9w made their first contribution in #​523
• @​inyourtime made their first contribution in #​530

Full Changelog: fastify/fastify-static@v8.2.0...v8.3.0

v8.2.0

Compare Source

What's Changed

• build(deps): bump @​fastify/send from 3.3.1 to 4.0.0 by @​dependabot[bot] in #​513
• Add example of sane cache-control settings when hosting a vite SPA by @​codyzu in #​512
• ci(ci): set job permissions by @​Fdawgs in #​514
• docs(readme): fix typo by @​codyzu in #​515
• Fix dirlist by @​jessekrubin in #​511
• docs(readme): update plugin version syntax by @​Fdawgs in #​516
• ci: set permissions at workflow level by @​Fdawgs in #​517
• ci: restore job level permissions by @​Fdawgs in #​518
• build(deps-dev): bump borp from 0.19.0 to 0.20.0 by @​dependabot[bot] in #​519
• build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @​dependabot[bot] in #​520
• Add globIgnore option by @​mcollina in #​521

New Contributors

• @​codyzu made their first contribution in #​512
• @​jessekrubin made their first contribution in #​511

Full Changelog: fastify/fastify-static@v8.1.1...v8.2.0

v8.1.1

Compare Source

What's Changed

• chore: rename master to main by @​Fdawgs in #​507
• fix: redirect to path with trailing slash even for preCompressed by @​genki in #​509

New Contributors

• @​genki made their first contribution in #​509

Full Changelog: fastify/fastify-static@v8.1.0...v8.1.1

v8.1.0

Compare Source

What's Changed

• build(dependabot): reduce npm updates to monthly by @​Fdawgs in #​504
• refactor: throw typeerror if type check fails by @​Fdawgs in #​505
• docs(readme): conciseness improvements by @​Fdawgs in #​506
• feat: add logLevel option by @​Jacopo47 in #​502

New Contributors

• @​Jacopo47 made their first contribution in #​502

Full Changelog: fastify/fastify-static@v8.0.4...v8.1.0

v8.0.4

Compare Source

What's Changed

• docs(readme): update ci badge syntax by @​Fdawgs in #​486
• fix: updated readme by @​Ankush1oo8 in #​487
• docs(readme): standardize compat table by @​Fdawgs in #​488
• build(deps-dev): finish standard to neostandard migration by @​Fdawgs in #​489
• types: use node: prefix for builtins by @​Fdawgs in #​490
• build(deps-dev): bump neostandard from 0.11.9 to 0.12.0 by @​dependabot in #​491
• build(deps-dev): add eslint, peer dep of neostandard by @​Fdawgs in #​492
• chore(package): add contribs and funding by @​Fdawgs in #​493
• docs(readme): replace link to send by @​Fdawgs in #​496
• Migration to node test runner by @​ilteoood in #​495
• docs(readme): spelling and grammar fixes by @​Fdawgs in #​498
• test: prefix unused params with underscores by @​Fdawgs in #​500
• refactor(index): throw typeerror if checking type by @​Fdawgs in #​499
• perf(index): use optional chaining by @​Fdawgs in #​501

New Contributors

• @​Ankush1oo8 made their first contribution in #​487
• @​ilteoood made their first contribution in #​495

Full Changelog: fastify/fastify-static@v8.0.3...v8.0.4

v8.0.3

Compare Source

What's Changed

• style: remove trailing whitespace by @​Fdawgs in #​478
• Fix types test for Fastify v5.1.0 by @​mcollina in #​479
• Explicit warning about setting cacheControl to false for custom Cache… by @​jablonski in #​481
• docs(readme): update send links by @​Fdawgs in #​482
• refactor: use lowercase for charset by @​Fdawgs in #​483
• fix: add contentType send option by @​Fdawgs in #​484

New Contributors

• @​jablonski made their first contribution in #​481

Full Changelog: fastify/fastify-static@v8.0.2...v8.0.3

v8.0.2

Compare Source

What's Changed

• fix: respect custom status code when successfully send file by @​climba03003 in #​476

Full Changelog: fastify/fastify-static@v8.0.1...v8.0.2

v8.0.1

Compare Source

What's Changed

• chore: update fastify to ^5.0.0 by @​Fdawgs in #​473

Full Changelog: fastify/fastify-static@v8.0.0...v8.0.1

v8.0.0

Compare Source

What's Changed

• build(deps-dev): bump pino from 8.21.0 to 9.1.0 by @​dependabot in #​453
• Merge next into master by @​jsumners in #​454
• build(deps): bump glob from 10.4.5 to 11.0.0 by @​dependabot in #​456
• build(deps-dev): bump @​types/node from 20.14.13 to 22.0.0 by @​dependabot in #​457
• chore: remove coveralls as dev dependency by @​Uzlopak in #​463
• chore: migrate to neostandard by @​Uzlopak in #​462
• chore: remove handlebars by @​Uzlopak in #​464

Full Changelog: fastify/fastify-static@v7.0.4...v8.0.0

v7.0.4

Compare Source

What's Changed

• Fix for files with % in filename by @​chetbox in #​452

New Contributors

• @​chetbox made their first contribution in #​452

Full Changelog: fastify/fastify-static@v7.0.3...v7.0.4

v7.0.3

Compare Source

What's Changed

• build(deps-dev): bump tsd from 0.30.7 to 0.31.0 by @​dependabot in #​446
• fix: wildcard head return content-length header by @​climba03003 in #​448

Full Changelog: fastify/fastify-static@v7.0.2...v7.0.3

v7.0.2

Compare Source

What's Changed

• chore(.gitignore): add .tap/ dir by @​Fdawgs in #​437
• build(deps-dev): bump @​typescript-eslint/parser from 6.21.0 to 7.1.0 by @​dependabot in #​442
• Retain path when using fallback precompressed path by @​colatkinson in #​445

New Contributors

• @​colatkinson made their first contribution in #​445

Full Changelog: fastify/fastify-static@v7.0.1...v7.0.2

v7.0.1

Compare Source

What's Changed

• build(deps-dev): bump @​fastify/compress from 6.5.0 to 7.0.0 by @​dependabot in #​433
• Optimize dirList by @​gurgunday in #​435
• fix: file not found errors when the root has a trailing slash by @​gurgunday in #​436

Full Changelog: fastify/fastify-static@v7.0.0...v7.0.1

v7.0.0

Compare Source

What's Changed

• build(deps-dev): bump tsd from 0.29.0 to 0.30.0 by @​dependabot in #​424
• docs(readme): replace fastify.io links with fastify.dev by @​Fdawgs in #​425
• docs(readme): replace fastify.io links with fastify.dev by @​Fdawgs in #​426
• chore(package): fix repository url by @​Fdawgs in #​429
• chore: improve types for setHeaders option by @​EvanHahn in #​428
• Upgrade glob to v10 by @​gurgunday in #​406

New Contributors

• @​EvanHahn made their first contribution in #​428

Full Changelog: fastify/fastify-static@v6.12.0...v7.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.