EUVD-2026-23243
GHSA-pr96-94w5-mx2h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth once list is enabled; impact is directory enumeration only, so C:L, I:N, A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 npm packages depend on @fastify/static (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 8.0.0.
DescriptionCVE.org
@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.
AnalysisAI
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths accessible to the Node.js process when the directory listing feature is explicitly enabled. The flaw resides in dirList.path(), which uses Node.js path.join() without verifying the resolved path remains within the configured static root, making URL sequences like /public/../etc/ sufficient to escape the intended boundary. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.02%), though the attack is automatable against susceptible configurations; disclosure is limited to directory and file names only - file contents are not readable via this path.
Technical ContextAI
The affected package is @fastify/static, an npm plugin for the Fastify web framework responsible for serving static assets and, optionally, directory listings (CPE: cpe:2.3:a:@fastify/static:@fastify/static). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the dirList.path() function constructs filesystem paths using Node.js's path.join(), which normalises traversal sequences such as '../' into a valid absolute path, but the function then uses the result without checking that it falls within the configured static root. This is a classic path traversal omission - the API resolves the path correctly but the caller never validates containment. The vulnerability is conditioned on the administrator having opted in to directory listing via the list plugin option, which is not active in default configurations.
RemediationAI
Upgrade @fastify/static to version 9.1.1 or later, which introduces a containment check in dirList.path() to prevent resolution outside the configured static root. This is a drop-in upgrade with no reported breaking changes. The authoritative advisory is at https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2h. For deployments that cannot immediately upgrade, the effective workaround is to remove the list option from the @fastify/static plugin configuration, which disables directory listing entirely and prevents the vulnerable code path from being reached; the trade-off is loss of browser-accessible directory browsing, with no impact on static file serving itself.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today