| Package | Affected versions | Patched versions |
|---|---|---|
| fastify-static | ≥ 8.0.0, < 9.1.1 | 9.1.1 |
| @fastify/static | ≥ 8.0.0, < 9.1.1 | 9.1.1 |
@fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path() to resolve a directory outside the root via path.join() without a containment check.
A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.
Upgrade to @fastify/static >= 9.1.1.
Disable directory listing by removing the list option from the plugin configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free