CVE-2026-6410: Fastify @fastify/static path traversal in directory listing

CVE-2026-6410 · Severity: medium · CVSS 5.3 · Published 2026-04-16

@fastify/static is a plugin for the Fastify web framework used to serve static files like images and documents. A security flaw in the directory listing feature allows unauthorized users to view the names of files and folders outside of the intended public directory. While this does not allow attackers to read the contents of the files, it exposes internal server structure and sensitive file names.

Technologies: Fastify Static, @fastify/static (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-6410 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6410 being exploited in the wild.
How severe is CVE-2026-6410?
Medium severity, with a CVSS score of 5.3, published 16 April 2026.
Which products and versions are affected?
Fastify Static >= 8.0.0, <= 9.1.0; @fastify/static (npm) >= 8.0.0, <= 9.1.0, SEMVER:introduced=8.0.0,fixed=9.1.1.
Is there a fix for CVE-2026-6410?
Yes. @fastify/static (npm): upgrade to 9.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6410 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-6410?
Check whether you run Fastify Static or @fastify/static (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @fastify/static (npm): upgrade to 9.1.1 or later
    npm install @fastify/static@9.1.1

Technical details

A path traversal vulnerability exists in @fastify/static versions 8.0.0 through 9.1.0 when the 'list' option is enabled. The root cause is the use of path.join() in the dirList.path() function without a subsequent containment check to ensure the resolved path remains within the configured static root. A remote, unauthenticated attacker can exploit this by sending crafted requests (e.g., /public/../outside/) to obtain directory listings for any directory accessible to the Node.js process. This discloses directory and filenames but does not permit reading file contents. The issue is fixed in version 9.1.1.

Affected products

  • Fastify @fastify/static >= 8.0.0, <= 9.1.0

Identifiers

  • CVE-2026-6410
  • GHSA-pr96-94w5-mx2h

Timeline

  • 2026-04-16: disclosed
  • 2026-04-16: advisory
  • 2026-04-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.