CVE-2026-6410

What it actually does

@fastify/static versions 8.0.0 through 9.1.0 contain a path traversal flaw when directory listing is enabled with the `list` option. The vulnerable directory-listing code resolves requested paths with `path.join()` but does not verify that the resolved directory remains inside the configured static root. A remote unauthenticated attacker can request traversal paths and cause the application to return directory listings for directories accessible to the Node.js process. The issue exposes directory and file names, but not file contents, and does not directly permit modification or code execution.

Why it matters to the business

Applications using affected @fastify/static versions with directory listing enabled may leak sensitive information about server-side directory structure, installed applications, deployment layouts, configuration file names, backups, source paths, or other files visible to the Node.js process. While the flaw does not expose file contents by itself, the disclosed names can materially assist follow-on attacks such as identifying secrets files, backup artifacts, source repositories, admin panels, or technology stacks. Because exploitation is remote, unauthenticated, and low complexity, internet-facing services should treat exposure as a priority even though the CVSS and EPSS values indicate moderate severity and no known CISA KEV exploitation at this time.

How an attack unfolds

An attacker first identifies a Fastify application serving static content with directory listing enabled. They then send crafted HTTP requests containing traversal sequences such as `../` or encoded variants to the static file route. Due to the missing containment check in the directory-listing path resolution logic, the application may resolve the requested directory outside the intended static root and return a generated listing of directory entries. The attacker reviews the disclosed directory and file names to map the filesystem layout, identify application frameworks, deployment paths, backup files, configuration filenames, log locations, or other high-value targets. The attacker can then use that reconnaissance to guide separate attacks, social engineering, credential hunting through other vulnerabilities, or attempts to access inadvertently exposed files through other routes.

How to fix it

Upgrade @fastify/static to version 9.1.1 or later. If immediate upgrade is not possible, disable directory listing by removing the `list` option from the @fastify/static plugin configuration. Review all Fastify services, monorepos, containers, and downstream packages that may bundle @fastify/static versions 8.0.0 through 9.1.0. After upgrading, rebuild and redeploy artifacts so the fixed dependency is actually present in production. As defense in depth, run the Node.js process with least-privilege filesystem access, avoid mounting unnecessary host directories into containers, restrict static routes to intended paths, and block traversal patterns at edge proxies or WAFs where feasible.

How to confirm the fix worked

Confirm dependency resolution shows @fastify/static 9.1.1 or later in package-lock.json, pnpm-lock.yaml, yarn.lock, npm ls, SBOM output, or container image scans. Confirm application configuration no longer enables `list` unless the fixed version is deployed. Test affected static routes with benign traversal probes such as URL-encoded `../` sequences and verify the application returns a 400, 403, 404, or equivalent denial rather than a directory index for paths outside the configured static root. Validate the deployed runtime artifact, not only source code, because bundled containers or serverless packages may retain the vulnerable dependency.

Typical attack path

1. Discover an application endpoint served by @fastify/static.
2. Test whether directory listing is enabled by requesting static directories and observing generated directory index responses.
3. Submit traversal requests using `../` or URL-encoded traversal sequences against the directory-listing route.
4. Receive directory listings for locations outside the configured static root if the service is vulnerable and the Node.js process has filesystem visibility.
5. Enumerate disclosed directory and file names to identify application structure, configuration filenames, backups, logs, source paths, or other targets.
6. Use the exposed filesystem metadata to support follow-on attacks against the same application or adjacent services.

How to detect it

Review HTTP access logs, reverse-proxy logs, CDN logs, WAF events, and application logs for requests to static routes containing path traversal sequences. Focus on unauthenticated requests using `../`, encoded traversal such as `%2e%2e%2f`, double-encoded traversal, backslash traversal, or repeated directory climbing. Correlate suspicious requests with successful 200 responses, unusually sized directory-index responses, HTML directory listing pages, or responses containing filenames outside the expected static asset tree. If available, inspect Fastify application logs for directory-listing handler activity and compare requested paths with the configured static root. Because this flaw discloses directory names rather than writing files or executing code, host artifacts may be minimal; forensic value is primarily in web request telemetry and any captured response bodies. Also review vulnerability scan traffic separately to distinguish benign testing from unknown external reconnaissance.

• ../
• ..%2f
• %2e%2e%2f
• %2e%2e/
• ..%5c
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• /etc/
• /proc/
• /var/
• /home/
• /root/
• /app/
• /usr/
• /opt/
• C:%5c
• C:/
• node_modules
• package.json
• package-lock.json
• pnpm-lock.yaml
• yarn.lock

What your security team should do

• Inventory all applications using @fastify/static and identify versions 8.0.0 through 9.1.0.
• Prioritize internet-facing Fastify services where directory listing is enabled via the `list` option.
• Upgrade to @fastify/static 9.1.1 or later and redeploy affected services.
• If an upgrade cannot be completed immediately, remove or disable the `list` option from @fastify/static configuration.
• Search web access logs for traversal attempts and unexpected directory-listing responses, especially on static asset routes.
• Add temporary WAF or reverse-proxy detection for traversal sequences targeting static routes, including encoded variants.
• Review disclosed directory names, if exploitation is suspected, to determine whether attackers may have learned sensitive deployment details.
• Ensure Node.js services run with least-privilege filesystem access and minimal container or host mounts.