CVE-2026-6410
mediumpriority · track · 0EPSS 0.005 · 43 %ileEUUSEPSS · scored 2026-10-27
@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-pr96-94w5-mx2h@fastify/static vulnerable to path traversal in directory listing2026-04-16ghsa · osvUS
### Impact `@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A request such as `/public/../outside/` causes `dirList.path()` to resolve a directory outside the root via `path.join()` without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed. ### Patches Upgrade to `@fastify/static` >= 9.1.1. ### Workarounds Disable directory listing by removing the `list` option from the plugin configuration.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-6410cnnvd
- https://github.com/fastify/fastify-static/releasesPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-6410cnnvd
- https://cna.openjsf.org/security-advisories.htmlenisa_euvd
- https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2henisa_euvd
- https://cna.openjsf.org/security-advisories.htmlThird Party Advisorynvd
- https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2hMitigationVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan