The vulnerability in @fastify/static allows a path traversal flaw when directory listing is enabled. A remote unauthenticated attacker can cause the plugin to resolve directories outside the configured static root and return the names of files and subdirectories present on any directory reachable by the Node.js process. The file contents themselves are not exposed, but the leaked names can aid in reconnaissance and further attacks.

Node.js applications that depend on @fastify/static versions 8.0.0 through 9.1.0 and have the directory listing (list) option enabled are affected. Any deployment using one of these plugin versions is at risk.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, but the remote unauthenticated access model and lack of containment checks make exploitation relatively straightforward for an attacker who can trigger the directory listing. The impact consists of exposing directory and file names to the attacker, which undermines confidentiality and may facilitate further exploitation.