GHSA-pr96-94w5-mx2h
@fastify/static vulnerable to path traversal in directory listing
Quick fix
GHSA-pr96-94w5-mx2h — @fastify/static: upgrade to the fixed version with the command below.
npm install @fastify/static@9.1.1Details
### Impact
`@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A request such as `/public/../outside/` causes `dirList.path()` to resolve a directory outside the root via `path.join()` without a containment check.
A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.
### Patches
Upgrade to `@fastify/static` >= 9.1.1.
### Workarounds
Disable directory listing by removing the `list` option from the plugin configuration.
Are you affected?
Enter the version of the package you're using.