GitHub Advisoryadvisory · npm

GHSA-pr96-94w5-mx2h @fastify/static vulnerable to path traversal in directory listing

MEDIUM Published 2026-04-16 Modified 2026-04-16 Official page ↗
Aliases
CVE-2026-6410
Ecosystem
npm
Packages
@fastify/static
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-04-16

Affected packages

• npm @fastify/static: >= 8.0.0, < 9.1.1 → fixed in 9.1.1

Description

Impact `@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A request such as `/public/../outside/` causes `dirList.path()` to resolve a directory outside the root via `path.join()` without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed. Patches Upgrade to `@fastify/static` >= 9.1.1. Workarounds Disable directory listing by removing the `list` option from the plugin configuration.

Related

Alias · CVE (1)

  • CVE-2026-6410 @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References