@fastify/static before 10.1.3 fails to canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. Unauthenticated attackers can use non-canonical paths to bypass route-based guards protecting a subtree and read protected static files. Upgrade to @fastify/static 10.1.3+.