Packages / @fastify/static / Security

ModerateVulnerabilityGHSA-pr96-94w5-mx2hCVE-2026-6410Published 16 Apr 2026

@fastify/static vulnerable to path traversal in directory listing

Affected releases · @fastify/static

  • 9.x9.0.0 – 9.1.0Fixed in 9.1.1
  • 8.x8.0.0 – 8.3.0No fix on this line yet

On 9.x, the newest line:

npm install @fastify/static@9.1.1
10.x

  1. Not affected

    10.0.0 – 10.1.7

    9 releases, latest

9.x

  1. Affected

    9.0.0 – 9.1.0

    2 releases

  2. Fixed

    9.1.1 – 9.3.0

    5 releases

8.x

  1. Affected

    8.0.0 – 8.3.0

    9 releases

54 stable releases of @fastify/static, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @fastify/static. It is read in your browser and sent nowhere.

What happens

Impact

@fastify/static v9.1.0 and earlier serves directory listings outside the configured static root when the list option is enabled. A request such as /public/../outside/ causes dirList.path() to resolve a directory outside the root via path.join() without a containment check.

A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.

Patches

Upgrade to @fastify/static >= 9.1.1.

Workarounds

Disable directory listing by removing the list option from the plugin configuration.