Executive brief
Restify is a lightweight Node.js web framework used to build REST APIs and web services. A flaw in the serveStatic static file serving function allows remote attackers to access files outside the intended directory through path traversal, potentially exposing sensitive configuration files, source code, or other protected resources on the server.
Technical details
A path traversal vulnerability exists in the serveStatic function within /lib/plugins/static.js in Restify versions up to 12.0.0. The vulnerability allows attackers to bypass directory restrictions and access arbitrary files on the filesystem by manipulating file path inputs (e.g., using relative path sequences like "../"). The attack vector is network-based and does not require authentication. An attacker can retrieve sensitive files, configuration data, or application source code. No vendor patch is currently available, as the vendor did not respond to early disclosure.
Affected products
- Restify node-restify up to 12.0.0
Timeline
- 2026-09-13: disclosed