CVE-2026-6410
Path Traversal in @fastify/static Allows Directory Disclosure
Publication date: 2026-04-16
Last updated on: 2026-04-23
Assigner: openjs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fastify | fastify-static | From 8.0.0 (inc) to 9.1.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in @fastify/static versions 8.0.0 through 9.1.0 when directory listing is enabled via the list option.
The issue arises because the dirList.path() function uses path.join() to resolve directories without checking if the resolved path stays within the configured static root.
As a result, a remote unauthenticated attacker can perform a path traversal attack to obtain directory listings for arbitrary directories accessible to the Node.js process.
While the attacker can see directory and file names, the contents of the files are not disclosed.
The vulnerability can be fixed by upgrading to @fastify/static version 9.1.1 or by disabling directory listing by removing the list option from the plugin configuration.
How can this vulnerability impact me? :
This vulnerability allows a remote unauthenticated attacker to obtain directory listings of arbitrary directories accessible to the Node.js process.
The attacker can discover directory and file names outside the intended static root, which may reveal sensitive information about the file structure.
However, the contents of the files are not disclosed, limiting the impact to information disclosure of file and directory names only.
This information disclosure could aid attackers in further attacks or reconnaissance.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade @fastify/static to version 9.1.1 or later.
As a workaround, disable directory listing by removing the list option from the plugin configuration.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a remote unauthenticated attacker to obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. Although file contents are not disclosed, the exposure of directory and file names could potentially lead to information disclosure risks.
Such information disclosure may impact compliance with standards and regulations like GDPR or HIPAA, which require protection of sensitive information and proper access controls. However, the CVE description does not explicitly state the impact on compliance with these regulations.