CVE-2026-6410

A flaw was found in @fastify/static. When directory listing is enabled, a remote unauthenticated attacker can exploit a path traversal vulnerability. This occurs because the dirList.path() function incorrectly resolves directories outside the configured static root. Successful exploitation allows the attacker to obtain directory listings for arbitrary directories, leading to the disclosure of directory and file names.