CVE-2026-90494

restify node-restify static.js serveStatic path traversal

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in the serveStatic method of restify node-restify versions up to 12.0.0 allows a remote attacker to craft a request path that includes traversal sequences and cause the server to serve files outside the intended static directory. This is a CWE-22 on the host file system, exposing sensitive data. The vulnerability description code; the impact is limited to information disclosure.

Affected Systems

All installations of restify node-restify 12.0.0 or earlier that use the serveStatic plugin in /lib/plugins/static.js. Any Node.js application that incorporates this static middleware is affected.

Risk and Exploitability

The CVSS score of 6.9 reflects moderate severity, while the EPSS score is < 1%, indicating a low but non-zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation to date. However a standard HTTP request to the static endpoint, still deploys the vulnerable serveStatic method carries a remote information disclosure risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade node-restify to a version newer than 12.0.0 that includes the fixed serveStatic implementation.
  • Limit the static directory served by restricting the path to a dedicated public subdirectory, ensuring that sensitive files are not exposed.
  • Add input validation to reject request paths containing ".." or other traversal patterns before they reach serveStatic, preventing unsafe path resolution.

Generated by OpenCVE AI on September 15, 2026 at 17:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Restify restify
Vendors & Products Restify restify
Type Values Removed Values Added
Description A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title restify node-restify static.js serveStatic path traversal
First Time appeared Restify
Restify node-restify
Weaknesses CWE-22
CPEs cpe:2.3:a:restify:node-restify:*:*:*:*:*:*:*:*
Vendors & Products Restify
Restify node-restify
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 21, 2026, 4:18 PM
Reserved
Sep 12, 2026, 8:15 AM

View source JSON

Updated
Sep 21, 2026, 4:18 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 4:17 AM
Modified
Sep 21, 2026, 5:19 PM

View source JSON

No data.

Updated
Sep 15, 2026, 5:45 PM

JSON