Reproducing the CVE-2026-106016 Path Traversal Bypass in @fastify/static

A hands-on walkthrough of CVE-2026-106016, the path traversal mitigation bypass in @fastify/static, showing how the flaw can be reproduced in a local Node.js app and what developers should do to patch and harden their static file serving.