vulnti.work

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume,…

中危 CVSS 5.3
CVECVE-2026-90982
首次发现2026-09-17 08:00 UTC
披露时间2026-09-17 07:16 UTC
最后更新2026-09-17 08:00 UTC
通道状态auto

摘要

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler…

中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。

深度研判

该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD