Vulnerability advisory

GHSA-pr96-94w5-mx2h

@fastify/static vulnerable to path traversal in directory listing

Published Apr 16, 2026Updated Apr 16, 2026OSV record ↗

Also known as CVE-2026-6410

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

@fastify/static npm

All @fastify/static advisories →

Affected	Fixed in
`8.0.0` to before 9.1.1	`9.1.1`Advisories →

Description

Impact

@fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path() to resolve a directory outside the root via path.join() without a containment check.

A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

Disable directory listing by removing the list option from the plugin configuration.