Executive brief
@fastify/static is a plugin for the Fastify web framework used to serve static files like images and documents. A security flaw in the directory listing feature allows unauthorized users to view the names of files and folders outside of the intended public directory. While this does not allow attackers to read the contents of the files, it exposes internal server structure and sensitive file names.
Technical details
A path traversal vulnerability exists in @fastify/static versions 8.0.0 through 9.1.0 when the 'list' option is enabled. The root cause is the use of path.join() in the dirList.path() function without a subsequent containment check to ensure the resolved path remains within the configured static root. A remote, unauthenticated attacker can exploit this by sending crafted requests (e.g., /public/../outside/) to obtain directory listings for any directory accessible to the Node.js process. This discloses directory and filenames but does not permit reading file contents. The issue is fixed in version 9.1.1.
Affected products
- Fastify @fastify/static >= 8.0.0, <= 9.1.0
Timeline
- 2026-04-16: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched
References
- https://api.github.com/users/yuki-matsuhashi
- https://github.com/yuki-matsuhashi
- https://api.github.com/users/yuki-matsuhashi/gists%7B/gist_id%7D
- https://api.github.com/users/yuki-matsuhashi/repos
- https://avatars.githubusercontent.com/u/250794953?v=4
- https://api.github.com/users/yuki-matsuhashi/events%7B/privacy%7D