{"id":"CVE-2026-6410","aliases":["GHSA-pr96-94w5-mx2h"],"url":"https://o3.security/vulnerability/CVE-2026-6410","summary":"@fastify/static vulnerable to path traversal in directory listing","details":"### Impact\n\n`@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A request such as `/public/../outside/` causes `dirList.path()` to resolve a directory outside the root via `path.join()` without a containment check.\n\nA remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.\n\n### Patches\n\nUpgrade to `@fastify/static` >= 9.1.1.\n\n### Workarounds\n\nDisable directory listing by removing the `list` option from the plugin configuration.","published":"2026-04-16T13:29:08.120Z","modified":"2026-08-12T03:51:21.901509915Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00506,"percentile":0.42025,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@fastify/static","fixedVersion":"9.1.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6410.json"},{"type":"ADVISORY","url":"https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6410"},{"type":"PACKAGE","url":"https://github.com/fastify/fastify-static"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:21.901509915Z"}}