CVE-2026-6410 @fastify/static vulnerable to path traversal in directory listing
An attacker can list arbitrary directories outside the static root if directory listing is enabled, disclosing file names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6410?
CVE-2026-6410 is a medium-severity path traversal vulnerability in @fastify/static, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join() without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names. File contents are not disclosed. Upgrade to @fastify/static 9.1.1 to fix this issue. As a workaround, disable directory listing by removing the list option from the plugin configuration.
Weakness: CWE-22
Which versions are affected by CVE-2026-6410?
2 open source packages ship an affected version, including @fastify/static. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/static npm | From 8.0.0 | 9.1.1 |
@fastify/static npm | From 8.0.0 | 9.1.1 |
Products include Fastify Fastify-Static.
How do I fix CVE-2026-6410?
Upgrade @fastify/static to 9.1.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-6410 being exploited?
There is no known exploitation of CVE-2026-6410 in the wild and no public exploit code.
Other vulnerabilities in @fastify/static
- CVE-2021-22964 DOS and Open Redirect with user input
- CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments
- CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal
- CVE-2021-22963 URL Redirection to Untrusted Site ('Open Redirect') in fastify-static
- CVE-2026-6414 @fastify/static vulnerable to route guard bypass via encoded path separators
Sources
Also known as GHSA-pr96-94w5-mx2h, MINI-mv5p-3p7r-8ghx.