@fastify/static vulnerable to path traversal in directory listing

TRUNG BÌNH 5.3CVE-2026-6410 · GHSA-pr96-94w5-mx2h · Công bố 16/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-6410 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng fastify-static (fastify), @fastify/static.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.51%, cao hơn 43.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.1.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
fastify-static fastify	`≥ 8.0.0, < 9.1.1`	`9.1.1`
@fastify/static npm	`≥ 8.0.0, < 9.1.1`	`9.1.1`

Mô tả

Impact

@fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path() to resolve a directory outside the root via path.join() without a containment check.

A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

Disable directory listing by removing the list option from the plugin configuration.

Mô tả của NVD

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.