{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "10.1.4"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "DESCRIPTION"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "a39a464728f3766e73272c22d2dd04fcf13f13e6"
            }
          ],
          "repo": "https://github.com/fastify/fastify-static",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-r799-r9gc-m956"
  ],
  "database_specific": {
    "cna_assigner": "openjs",
    "cwe_ids": [
      "CWE-178",
      "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90982.json"
  },
  "details": "@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler, yet the filesystem resolves it to the same protected file. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization. As a workaround, serve static files from a case-sensitive filesystem, or ensure route guards and allowedPath rules account for every letter-case variant of the protected paths.",
  "id": "CVE-2026-90982",
  "modified": "2026-09-20T11:30:15.465069971Z",
  "published": "2026-09-17T06:55:42.300Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://cna.openjsf.org/security-advisories.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90982.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/fastify/fastify-static/security/advisories/GHSA-r799-r9gc-m956"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90982"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@fastify/static vulnerable to route guard bypass via path case-folding"
}