Path Traversal Vulnerability in Restify by Restify Project
CVE-2026-90494

6.9MEDIUM

Key Information:

Vendor

Restify

Status
Node-restify
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90494?

A significant flaw has been identified in the Restify library, specifically in the serveStatic function located in /lib/plugins/static.js. This vulnerability allows attackers to exploit path traversal, potentially granting unauthorized access to sensitive files on the server. The attack can be initiated remotely, raising substantial security concerns for users of affected versions up to 12.0.0. Despite early disclosures to the vendor, there has been no response regarding remediation or acknowledgment.

Affected Version(s)

node-restify 12.0

References

https://vuldb.com/vuln/403082
vdb-entrytechnical-description
https://vuldb.com/vuln/403082/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90494
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ciphersecuritylabs (VulDB User)
VulDB CNA Team
.