Description

A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T04:17:15.373Z",
  "pubdate": "2026-09-13T04:17:15.373Z",
  "executiveSummary": "A path traversal vulnerability exists within the serveStatic function of the node-restify library, affecting versions up to 12.0.0. This security flaw allows unauthenticated remote attackers to circumvent directory restrictions and access arbitrary files within the server's filesystem.\nThe vulnerability is rooted in improper input sanitization within the static file serving middleware. By manipulating request paths—typically using dot-dot-slash (../) sequences—an attacker can traverse outside the intended root directory to read sensitive configuration files, source code, or system credentials.\nThe risk implication is critical, as it facilitates unauthorized information disclosure. Because the attack can be initiated remotely without requiring authentication, the potential for data exfiltration is high. The lack of vendor response indicates that downstream users must implement their own compensating controls to mitigate the exposure, as no official patch is currently identified to resolve this specific implementation flaw in the affected versions.",
  "technicalDetails": "The vulnerability originates in the /lib/plugins/static.js file within the serveStatic function, which is responsible for mapping incoming HTTP requests to physical files on the server's storage.\nThe root cause of the flaw is the failure of the application to properly sanitize and normalize user-supplied URI paths before they are concatenated with the configured root directory path. In standard web server configurations, path traversal protection mechanisms are expected to reject or filter out directory traversal sequences like '../' or encoded variations before filesystem access occurs.\nWhen an attacker initiates a request with a crafted path, such as '/public/../../etc/passwd', the serveStatic function improperly processes the request by resolving the relative path against the application's document root. Because the library fails to validate that the resolved absolute path remains within the intended boundary, the Node.js 'fs' module or equivalent internal file-serving primitives are instructed to read a file outside of the established 'static' directory.\nThe exploitation method relies on the attacker's ability to manipulate the 'req.url' object or similar parameters intercepted by the static middleware. The attack flow proceeds as follows: 1) The attacker sends a GET request to an endpoint configured to use serveStatic. 2) The crafted payload includes traversal sequences designed to escape the web root. 3) The serveStatic function incorrectly processes the path normalization, treating the traversal sequences as valid navigation instructions. 4) The server reads the file content from the attacker-specified path. 5) The server returns the sensitive file content to the remote attacker in the HTTP response body.\nThis vulnerability is reachable remotely and does not require any prior authentication or special administrative privileges. The primary requirement is that the target server must have an endpoint utilizing the serveStatic plugin. The impact of successful exploitation is total unauthorized read access to any file accessible by the system user running the node-restify process, potentially leading to the leakage of environment variables, application keys, database credentials, or system files that could be leveraged for deeper exploitation or privilege escalation."
}