gofiber/fiber · warning · ErrInvalidPath

invalid path

Error message

invalid path

What it means

Declared as ErrInvalidPath in static/static.go and returned internally by sanitizePath / unescapePathString when a request path is unsafe: invalid percent-encoding, backslashes, NUL bytes, parent-directory (..) traversal, a leading '//', a Windows volume name, or a drive letter like 'C:'. It is a path-traversal / path-confusion guard. In the handler the error is not returned to the client; the path is rewritten to invalidPathSentinel so fasthttp responds 404.

Source

Thrown at middleware/static/static.go:23

	"errors"
	"fmt"
	"io/fs"
	"net/url"
	"os"
	pathpkg "path"
	"path/filepath"
	"slices"
	"strconv"
	"strings"
	"sync"

	"github.com/gofiber/utils/v2"
	"github.com/valyala/fasthttp"

	"github.com/gofiber/fiber/v3"
)

var ErrInvalidPath = errors.New("invalid path")

const invalidPathSentinel = "/__fiber_invalid__"

func bytesToPathString(p []byte) string {
	if bytes.IndexByte(p, '\\') >= 0 {
		b := make([]byte, len(p))
		copy(b, p)
		for i := range b {
			if b[i] == '\\' {
				b[i] = '/'
			}
		}
		return utils.UnsafeString(b)
	}

	return utils.UnsafeString(p)
}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Treat occurrences as expected security behavior — no action needed; the 404 is the correct response.
2. If a legitimate asset path is rejected, simplify/normalize the URL (remove //, backslashes, or unnecessary percent-encoding) at the client/cdn level.
3. Set Config.NotFoundHandler to serve a custom 404 or index.html for SPA fallback if needed.
4. Confirm the asset actually exists under root and the request method is GET/HEAD (other methods skip the handler).

Example fix

// before
app.Use("/assets", static.New("./public"))

// after — graceful SPA fallback for rejected/missing paths
app.Use("/assets", static.New("./public", static.Config{
    NotFoundHandler: func(c fiber.Ctx) error {
        return c.SendFile("./public/index.html")
    },
}))

// The handler converts ErrInvalidPath into a 404 automatically; handle it there.
app.Use("/assets", static.New("./public", static.Config{
    NotFoundHandler: func(c fiber.Ctx) error {
        return c.Status(fiber.StatusNotFound).SendString("not found")
    },
}))

When it happens

Trigger: Requests such as GET /..%2f..%2fetc/passwd, GET /%00, GET \server\share (backslash), GET //etc/passwd, or GET /C:/Windows/system32 against a static.New root. sanitizePath rejects these; the client sees a 404, and any NotFoundHandler runs.

Common situations: Scanners/bots probing for path traversal; clients sending raw backslashes on Windows-rooted deployments; misconfigured reverse proxies forwarding unnormalized paths; legitimate (but unusual) encoded paths that trip the guards.

Related errors

• field must not contain CR or LF
• tls: AutoCertManager cannot be combined with CertFile/CertKe
• log: context tag name and function are required
• csrf: token not found
• csrf: sec-fetch-site header invalid

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/efede1593eca2103.json. Report an issue: GitHub.