CVE-2026-90982: @fastify/static Improper Handling of Case Sensitivity

Vulnerability summary

CVE-2026-90982 is a medium (CVSS 5.3) Improper Handling of Case Sensitivity vulnerability in @fastify/static. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.9% of scored vulnerabilities.

Timeline

1. 17-09-2026
   PublishedVulnerability first disclosed.
2. 17-09-2026
   Last modifiedVulnerability information updated.

Description

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler, yet the filesystem resolves it to the same protected file. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization. As a workaround, serve static files from a case-sensitive filesystem, or ensure route guards and allowedPath rules account for every letter-case variant of the protected paths.

• CWE-178Improper Handling of Case SensitivityThe product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.