Description
A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| restify | node-restify | 12.0 | — |
References
- VDB-403082 | restify node-restify static.js serveStatic path traversal vdb-entry technical-description
- VDB-403082 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-90494 | CVE Analysis and Report third-party-advisory
- Submit #892870 | Restify Project node-restify 11.1.0 Path Traversal third-party-advisory