CVE-2026-6414

CVE-2026-6414 is a path traversal vulnerability affecting @fastify/static versions 8.0.0 through 9.1.0. The flaw stems from a discrepancy in how percent-encoded path separators (%2F) are handled between the static file module and Fastify's router, allowing attackers to bypass route-based middleware and security guards that protect sensitive files. Users should upgrade to @fastify/static version 9.1.1 immediately, as no workarounds are available. The vulnerability carries a CVSS score of 5.9 (Medium severity) with a network attack vector and high attack complexity. While the impact is limited to confidentiality breaches with no integrity or availability concerns, the lack of authentication requirements means any unauthenticated network user could potentially exploit it. The attack requires specific conditions to succeed, reflected in the high complexity rating. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list, and community attention remains minimal, as indicated by its inactive status on vulnerability hot lists. However, given the straightforward nature of path encoding techniques, organizations should treat this as a routine patching priority rather than an emergency response.