Node Restify
Monthly
Path traversal in node-restify's serveStatic plugin exposes arbitrary server-side files to unauthenticated remote attackers on all versions up to and including 12.0.0. The serveStatic function in /lib/plugins/static.js fails to adequately sanitize user-controlled path segments, allowing traversal sequences to escape the intended static file root and return files from elsewhere on the filesystem. No vendor patch is available - the maintainer did not respond to responsible disclosure - leaving affected deployments without an official fix.
Path traversal in node-restify's serveStatic plugin exposes arbitrary server-side files to unauthenticated remote attackers on all versions up to and including 12.0.0. The serveStatic function in /lib/plugins/static.js fails to adequately sanitize user-controlled path segments, allowing traversal sequences to escape the intended static file root and return files from elsewhere on the filesystem. No vendor patch is available - the maintainer did not respond to responsible disclosure - leaving affected deployments without an official fix.