{"id":"CVE-2026-6410","aliases":["EUVD-2026-23243","GHSA-pr96-94w5-mx2h"],"status":"published","title":"@fastify/static vulnerable to path traversal in directory listing","description":"@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00506,"percentile":0.4347,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-04-16T13:29:08Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"npm","package":"@fastify/static","fixed_in":["9.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@fastify/static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"9.1.0"},{"fixed":"9.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@fastify/static","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"9.1.1"}]}]}],"products":[{"vendor":"@fastify/static","product":"@fastify/static"},{"vendor":"fastify","product":"fastify-static"}],"references":[{"url":"https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2h","tags":["Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6410","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pr96-94w5-mx2h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6410.json","tags":["advisory"]},{"url":"https://github.com/fastify/fastify-static","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-6410","title":"@fastify/static vulnerable to path traversal in directory listing","description":"@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.","status":"published","published":"2026-04-16T13:29:08.12Z","modified":"2026-04-16T14:19:36.78Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-23243","description":"@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.","status":"published","published":"2026-04-16T13:29:08Z","modified":"2026-04-16T14:19:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:23.841547Z"}],"ghsa":[{"id":"GHSA-pr96-94w5-mx2h","title":"@fastify/static vulnerable to path traversal in directory listing","description":"### Impact\n\n`@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A request such as `/public/../outside/` causes `dirList.path()` to resolve a directory outside the root via `path.join()` without a containment check.\n\nA remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.\n\n### Patches\n\nUpgrade to `@fastify/static` \u003e= 9.1.1.\n\n### Workarounds\n\nDisable directory listing by removing the `list` option from the plugin configuration.","status":"published","published":"2026-04-16T22:34:30Z","modified":"2026-04-16T22:34:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:55.105822Z"}],"nvd":[{"id":"CVE-2026-6410","description":"@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.","status":"published","published":"2026-04-16T14:16:20.173Z","modified":"2026-06-17T11:00:47.853Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:14.748836Z"}],"osv":[{"id":"CVE-2026-6410","title":"@fastify/static vulnerable to path traversal in directory listing","description":"@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.","status":"published","published":"2026-04-16T13:29:08.12Z","modified":"2026-10-28T02:30:39.82638016Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:13.752441Z"},{"id":"GHSA-pr96-94w5-mx2h","title":"@fastify/static vulnerable to path traversal in directory listing","description":"### Impact\n\n`@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A request such as `/public/../outside/` causes `dirList.path()` to resolve a directory outside the root via `path.join()` without a containment check.\n\nA remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.\n\n### Patches\n\nUpgrade to `@fastify/static` \u003e= 9.1.1.\n\n### Workarounds\n\nDisable directory listing by removing the `list` option from the plugin configuration.","status":"published","published":"2026-04-16T22:34:30Z","modified":"2026-04-16T22:56:28.683376Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}