AIKIDO-2026-304658

TL;DR

@fastify/static relies on the find-my-way router to match routes before path normalization, so non-leading .. and %2E%2E path segments are not neutralized before the static plugin's catch-all route handles the request. A request such as /foo/../deep/secret.txt matches the static route instead of a guarded route, bypassing route-based middleware or guards meant to protect those files. The dot-dot segments survive the decodeURI plus encodeURI round-trip and are then collapsed by @fastify/send before its own traversal guard runs. The fix normalizes the pathname so guarded routes match before the file is served.