@fastify/static EUVD-2026-23243

Exploitation requires that the Fastify application has explicitly configured the list option in the @fastify/static plugin - directory listing is disabled by default and must be intentionally enabled by the application developer. Without this option, the dirList.path() function is never invoked and the vulnerability is not reachable. Once that condition is met, no authentication is required (CVSS PR:N) and no user interaction is needed, making the attack fully automated. Key limiting factors: only directory and file names are disclosed - file contents cannot be read via this vulnerability; the Node.js process must have OS-level read permission on the target directory for a listing to be returned; and the affected version range is bounded to 8.0.0-9.1.0, so deployments on older or already-patched versions are not affected.

The CVSS 3.1 score of 5.3 Medium reflects a network-reachable, unauthenticated, zero-complexity attack (AV:N/AC:L/PR:N/UI:N) with limited confidentiality impact (C:L) and no integrity or availability impact. This scoring is consistent with the actual impact - directory and filename enumeration only. EPSS at 0.02% (4th percentile) is very low, and the SSVC framework corroborates this with Exploitation: none and Technical Impact: partial, indicating no observed exploitation and bounded blast radius. The SSVC Automatable: yes flag is the main escalation risk - once a POC exists, mass scanning is trivial. The non-default prerequisite (list option must be explicitly enabled) meaningfully shrinks the exposed population; deployments using default @fastify/static configurations are not affected. Real-world priority is moderate for organisations that have enabled directory listing and cannot immediately upgrade; low for all others. No data conflicts exist between sources - all signals align on a contained, patchable, currently unexploited issue.

An attacker identifies a Fastify application that has enabled directory listing via the list option in @fastify/static. They send an unauthenticated HTTP GET request with a path traversal sequence such as GET /assets/../../etc/ HTTP/1.1, causing dirList.path() to resolve to /etc/ on the server. The response returns a directory listing containing filenames and subdirectory names from /etc/, revealing configuration file names, user directories, or other sensitive path structure without requiring any credentials or prior knowledge of the server layout.