https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-18427.htmlhttps://patchthecve.com/cve/CVE-2026-18427.htmlFri, 04 Sep 2026 18:16:20 +0000HIGH 7.5: @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating thttps://patchthecve.com/cve/CVE-2026-7120.htmlhttps://patchthecve.com/cve/CVE-2026-7120.htmlTue, 28 Jul 2026 17:05:24 +0000MEDIUM 5.3: @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent non-cahttps://patchthecve.com/cve/CVE-2026-15074.htmlhttps://patchthecve.com/cve/CVE-2026-15074.htmlTue, 28 Jul 2026 17:02:14 +0000HIGH 7.5: @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segmen