PT-2026-33321 · Npm · Fastify-Static

Climba03003 + 3 · Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-6410

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions @fastify/static versions 8.0.0 through 9.1.0

Description Path traversal occurs when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names, although file contents are not disclosed.

Recommendations Upgrade to version 9.1.1. As a temporary workaround, disable directory listing by removing the list option from the plugin configuration.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-6410

GHSA-PR96-94W5-MX2H

Affected Products

Fastify-Static

References · 9

• https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6410 · Security Note
• https://osv.dev/vulnerability/GHSA-pr96-94w5-mx2h · Vendor Advisory
• https://github.com/fastify/fastify-static · Note
• https://twitter.com/VulmonFeeds/status/2044866257288061396 · Twitter Post
• https://twitter.com/CVEnew/status/2045102681195168244 · Twitter Post
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/infoflowcloud/status/2045105177825284547 · Twitter Post
• https://twitter.com/kom_256/status/2044772309236363306 · Twitter Post