CVE-2026-6414

Katalog CVE

CVSS 5.9 · Medium EPSS 0,45%

Kerentanan Improper Handling of URL Encoding (Hex Encoding) pada fastify-static. Skor CVSS 3.1 5.9 (Medium) menurut CNA.

Deskripsi (NVD)

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that protect files served by @fastify/static. For example, a route guard on a protected path can be circumvented by encoding the path separator in the URL. Upgrade to @fastify/static 9.1.1 to fix this issue. There are no workarounds.

Rincian

Terbit di NVD

16 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-177: Improper Handling of URL Encoding (Hex Encoding)

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92 advisory vendor
• https://cna.openjsf.org/security-advisories.html advisory pihak ketiga
• https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p not applicable
• https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr not applicable