Path Traversal Vulnerability in @fastify/static by Fastify

CVE-2026-6410

What is CVE-2026-6410?

The @fastify/static package versions 8.0.0 to 9.1.0 contain a significant path traversal vulnerability that occurs when directory listing is enabled by the 'list' option. This flaw allows a remote, unauthenticated attacker to retrieve directory listings of arbitrary directories that are accessible to the Node.js process. This is facilitated by the dirList.path() function, which resolves directories outside the designated static root due to a lack of containment checks when utilizing path.join(). Although file contents remain secure, this vulnerability poses a risk of exposing sensitive directory and file names. Users are advised to upgrade to @fastify/static version 9.1.1 to address this issue, or alternatively, disable directory listing by removing the 'list' option from their configuration.

References