CVE-2026-6410 Details
Description
@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.
A path traversal vulnerability has been identified in the @fastify/static package, affecting versions 8.0.0 through 9.1.0. When directory listing is enabled via the 'list' option, the 'dirList.path()' function can resolve directories outside the configured static root. This is achieved using 'path.join()' without proper containment checks. As a result, a remote unauthenticated attacker can access directory listings of arbitrary directories available to the Node.js process, revealing directory and file names, although file contents remain undisclosed.
Users are advised to upgrade to @fastify/static version 9.1.1 or later. As a temporary workaround, directory listing can be disabled by removing the 'list' option from the plugin configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Third Party Advisory |
| https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2h | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | openjs |
Affected Products
| Product | Versions |
|---|---|
| fastify fastify-static | >= 8.0.0, < 9.1.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Reanalysis | [email protected] |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 16, 2026 | New CVE Received | openjs |