CVE-2026-6410: falha de média gravidade em @fastify/static
@fastify/static vulnerable to path traversal in directory listing
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
@fastify/static · @fastify/staticCVEs relacionadas — @fastify/static
No mesmo produto, das mais perigosas para as menos.
CVE-2026-15074HIGH@fastify/static vulnerable to route guard bypass via path traversalEPSS 0.7%CVE-2026-18427HIGH@fastify/static vulnerable to route guard bypass via non-canonical path segmentsEPSS 0.7%CVE-2026-90982MEDIUM@fastify/static vulnerable to route guard bypass via path case-foldingEPSS 0.6%CVE-2026-6414MEDIUM@fastify/static vulnerable to route guard bypass via encoded path separatorsEPSS 0.4%CVE-2026-7120MEDIUM@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL PathsEPSS 0.4%