chore(deps): update dependency @fastify/static to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@fastify/static	^8.0.4 || ^9.0.0 → ^10.0.0
@fastify/static	9.3.0 → 10.1.2

---

@​fastify/static vulnerable to route guard bypass via path traversal

CVE-2026-15074 / GHSA-83w8-p2f5-377r

More information

Details

Impact

@fastify/static is vulnerable to a bypass of route-based middleware and guards via non-leading .. and %2E%2E path segments. find-my-way does not normalize .. when matching routes, so a request such as /foo/../deep/secret.txt matches the static plugin's catch-all instead of the guarded /deep/*. The getPathnameForSend helper introduced by the fix for GHSA-x428-ghpx-8j92 only guards against the %2F variant; .. and %2E%2E survive the decodeURI + encodeURI round-trip and are then collapsed away by @fastify/send's path.normalize before its own traversal guard runs.

Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with non-leading dot-dot path segments.

Patches

Upgrade to @fastify/static 10.1.1.

Workarounds

Do not use route-based middlewares or guards to protect files served by @fastify/static.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-83w8-p2f5-377r
• https://nvd.nist.gov/vuln/detail/CVE-2026-15074
• https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/releases/tag/v10.1.1
• https://github.com/advisories/GHSA-83w8-p2f5-377r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

CVE-2026-7120 / GHSA-8pvw-jcv7-9cmj

More information

Details

Impact

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file on disk.

Applications that use allowedPath as a security boundary to restrict access to specific static files or path subtrees may unintentionally expose files that were intended to be denied.

Patches

Upgrade to @fastify/static >= 10.1.2.

Workarounds

None. Upgrade to the patched version.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/fastify/fastify-static/security/advisories/GHSA-8pvw-jcv7-9cmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-7120
• https://github.com/fastify/fastify-static/commit/878c72e920fabacf7e37739bf78057044717bf63
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-static/releases/tag/v10.1.2
• https://github.com/advisories/GHSA-8pvw-jcv7-9cmj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fastify/fastify-static (@​fastify/static)

v10.1.2

Compare Source

⚠️ Security Release

• Fix for GHSA-8pvw-jcv7-9cmj

What's Changed

• ci: pin actions to commit-hash by @​Fdawgs in #​601

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

Compare Source

⚠️ Security Release

• Fix for GHSA-83w8-p2f5-377r

What's Changed

• docs(readme): fix typos by @​Fdawgs in #​600

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

Compare Source

What's Changed

• fix: set Vary: Accept-Encoding for preCompressed responses by @​LeSingh1 in #​586
• feat: use @fastify/error for errors and add option suppressWarning by @​climba03003 in #​599

New Contributors

• @​LeSingh1 made their first contribution in #​586

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Compare Source

Breaking Changes

• setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers.
For example,

// Before
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@​fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(res) {
    res.setHeader('X-Test', 'Foo')
  }
})
// After
const fastify = require('fastify')({logger: true})
const path = require('node:path')

fastify.register(require('@​fastify/static'), {
  root: path.join(__dirname, 'public'),
  prefix: '/public/', // optional: default '/',
  setHeaders(reply) {
    reply.header('X-Test', 'Foo')
  }
})

What's Changed

• chore!: bump content-disposition fom 1.0.1 to 2.0.1 by @​climba03003 in #​597
• fix: ignore unsupported deflate for precompressed assets by @​jibin7jose in #​596
• fix!: allow setHeaders to override send headers by @​climba03003 in #​598

New Contributors

• @​jibin7jose made their first contribution in #​596

Full Changelog: fastify/fastify-static@v9.3.0...v10.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @nestjs/platform-fastify@11.1.28
npm error Found: @fastify/static@10.1.2
npm error node_modules/@fastify/static
npm error   dev @fastify/static@"10.1.2" from the root project
npm error
npm error Could not resolve dependency:
npm error peerOptional @fastify/static@"^8.0.0 || ^9.0.0" from @nestjs/platform-fastify@11.1.28
npm error node_modules/@nestjs/platform-fastify
npm error   dev @nestjs/platform-fastify@"11.1.28" from the root project
npm error
npm error Conflicting peer dependency: @fastify/static@9.3.0
npm error node_modules/@fastify/static
npm error   peerOptional @fastify/static@"^8.0.0 || ^9.0.0" from @nestjs/platform-fastify@11.1.28
npm error   node_modules/@nestjs/platform-fastify
npm error     dev @nestjs/platform-fastify@"11.1.28" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-30T20_28_50_241Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-30T20_28_50_241Z-debug-0.log