Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

@fastify/static

Ecosystem:
npm
Package URL:
pkg:npm/@fastify/static
Total PRs:
392 Dependabot PRs
Latest PR:
3 days ago
Unique Repositories:
176 repositories
Unique Repos (30 days):
11 repositories
Security Advisories
@fastify/static vulnerable to path traversal in directory listing
GHSA-pr96-94w5-mx2h CVE-2026-6410 MODERATE published 2 months ago • updated 3 days ago
### Impact `@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A ...
@fastify/static vulnerable to route guard bypass via encoded path separators
GHSA-x428-ghpx-8j92 CVE-2026-6414 MODERATE published 2 months ago • updated about 1 month ago
### Impact `@fastify/static` v9.1.0 and earlier decodes percent-encoded path separators (`%2F`) before filesystem resolution, but Fastify's router...
Recent PRs (filtered by: Open , Patch PRs )
RSS Feed Clear filter
chore(deps): bump the minor-and-patch group across 1 directory with 11 updates

pixel-agents-hq/pixel-agents #308

9.1.1 → 9.1.3 Patch PR
Open 3 days ago 1 comment
pixel-agents-hq
chore(deps): bump the production-dependencies group with 5 updates

berntpopp/VarLens #252

9.1.1 → 9.1.3 Patch PR
Open 16 days ago 1 comment
berntpopp
BAU: Bump the production-dependencies group with 10 updates

govuk-one-login/account-components #743

9.1.2 → 9.1.3 Patch PR
Open about 2 months ago 1 comment
govuk-one-login
chore(deps): bump the minor-and-patch group with 9 updates

htxryan/pearl #24

9.1.0 → 9.1.3 Patch PR
Open about 2 months ago 1 comment
htxryan
chore(deps): bump the production-deps group across 1 directory with 8 updates

Yash-Awasthi/aibyai #30

9.1.1 → 9.1.2 Patch PR
Open about 2 months ago 1 comment
Yash-Awasthi
BAU: Bump @fastify/static from 9.1.0 to 9.1.1

govuk-one-login/account-components #694

9.1.0 → 9.1.1 Patch PR
Open 2 months ago 1 comment
govuk-one-login
chore(deps): bump @fastify/static from 9.1.0 to 9.1.1

assixx-dev/Assixx #208

9.1.0 → 9.1.1 Patch PR
Open 2 months ago 1 comment
assixx-dev
chore(deps): bump @fastify/static from 9.1.0 to 9.1.1

forbiddenlink/specter #42

9.1.0 → 9.1.1 Patch PR
Open 2 months ago 2 comments
forbiddenlink
Package Details
Name: @fastify/static
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/@fastify/static
JSON API: View JSON
Security Advisories

2

Active advisories
MODERATE 2
View All npm Advisories
Package Information
Description:

Plugin for serving static files as fast as possible.

Repository: https://github.com/fastify/fastify-static
Homepage: https://github.com/fastify/fastify-static
Latest Release: 8.2.0
about 1 year ago
Dependent Repos: 2,807
Dependent Packages: 280
Downloads: 4,706,292
Ranking: Top 0.4313% by dependent repos Top 0.2113% by downloads Top 0.234% by dependent pkgs
PR Status
Open 180 (45.9%)
Merged 17 (4.3%)
Closed 164 (41.8%)
PR Types
Major 76 (19.4%)
Minor 253 (64.5%)
Patch 30 (7.7%)
Removal 2 (0.5%)