TI-2026-05626 Aliases CVE-2026-6410 GHSA-pr96-94w5-mx2h

@fastify/static vulnerable to path traversal in directory listing

LOW 31CWE-22Published 2026-04-16 · Updated 2026-04-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00506 43rd percentileScored 2026-11-07

Fix Partial @fastify/static (@fastify/static): 9.1.1@fastify/static (npm): 9.1.1Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fastify	@fastify/static	8.0.0 to before 9.1.1	9.1.1	Patch available	CNA
—	@fastify/static (npm)	8.0.0 to before 9.1.1	9.1.1	Patch available	GHSA-pr96-94w5-mx2h

@fastify/static Vendorfastify Affected 8.0.0 to before 9.1.1 Fixed in 9.1.1 Patch available CNA
@fastify/static (npm) Vendor— Affected 8.0.0 to before 9.1.1 Fixed in 9.1.1 Patch available GHSA-pr96-94w5-mx2h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fastify:fastify-static::::::::	8.0.0 to before 9.1.1	Vulnerable	fastify

cpe:2.3:a:fastify:fastify-static:*:*:*:*:*:*:*:* Versions 8.0.0 to before 9.1.1 Vulnerable ·fastify

Remediation

Fix · CNA @fastify/static (@fastify/static) Fixed in 9.1.1
Fix · GHSA-pr96-94w5-mx2h @fastify/static (npm) Fixed in 9.1.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-04-16
@fastify/static 9.1.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-05629 @fastify/static vulnerable to route guard bypass via encoded path separatorsPriority LOW 27
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-6410
2026-10-03 Alias added: GHSA-pr96-94w5-mx2h

References

Advisory 3

Other 1

https://github.com/fastify/fastify-static

TI-2026-15143 @fastify/static vulnerable to route guard bypass via non-canonical path segments CVSS 3.1HIGH 7.5
TI-2026-12689 @fastify/static vulnerable to route guard bypass via path traversal CVSS 3.1HIGH 7.5
TI-2021-05825 Uncontrolled resource consumption in https://github.com/fastify/fastify-static CVSS 3.1HIGH 8.8
TI-2026-06243 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVSS 3.1MEDIUM 5.3
TI-2021-05824 Open redirect in https://github.com/fastify/fastify-static CVSS 3.1MEDIUM 6.1
TI-2026-05629 @fastify/static vulnerable to route guard bypass via encoded path separators CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences