CVE-2026-90494 Overview
CVE-2026-90494 is a path traversal vulnerability [CWE-22] in the restify node-restify framework through version 12.0.0. The flaw resides in the serveStatic function within /lib/plugins/static.js. Attackers can manipulate request paths to access files outside the intended static directory. The issue is remotely exploitable over the network without authentication or user interaction. According to the CVE record, the vendor was contacted about this disclosure but did not respond.
Critical Impact
Unauthenticated remote attackers can traverse directories through the serveStatic plugin to read files outside the served root, potentially exposing configuration files, source code, or other sensitive data.
Affected Products
- restify node-restify up to and including version 12.0.0
- Applications using the serveStatic plugin from /lib/plugins/static.js
- Node.js services embedding vulnerable restify releases
Discovery Timeline
- 2026-09-13 - CVE-2026-90494 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90494
Vulnerability Analysis
The vulnerability affects the serveStatic function in restify's static file plugin (/lib/plugins/static.js). The function fails to properly normalize and validate user-supplied path components before resolving them against the configured static directory. An attacker crafts an HTTP request containing traversal sequences such as ../ to escape the intended document root. Because restify is a network-facing framework used for HTTP APIs, the attack surface is directly exposed to remote, unauthenticated clients.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory, mapped to CWE-22. The serveStatic handler resolves request paths without sufficient sanitization or canonical path enforcement. Sequences that traverse parent directories are honored during file resolution, allowing the returned file to fall outside the configured base directory.
Attack Vector
Exploitation requires only network access to an HTTP endpoint that mounts the serveStatic plugin. An attacker issues a GET request whose path contains directory traversal segments targeting a file above the served root. No authentication, privileges, or user interaction are required. The EPSS score is 0.55% with a percentile of 44.884, indicating limited observed exploitation prediction at publication time. Refer to the VulDB CVE-2026-90494 entry for additional technical detail.
No verified proof-of-concept code has been published. The exploitation pattern follows the standard path traversal model: an HTTP request containing encoded or literal parent-directory sequences appended to a static resource path, resulting in the server returning a file located outside the intended directory.
Detection Methods for CVE-2026-90494
Indicators of Compromise
- HTTP request logs containing ../, ..%2f, ..%5c, or double-encoded traversal sequences targeting endpoints served by restify
- Access log entries returning HTTP 200 for paths outside the expected static directory tree
- Unexpected reads of sensitive files such as /etc/passwd, .env, or application configuration files by the Node.js process
Detection Strategies
- Inspect web server and reverse proxy logs for encoded traversal patterns directed at routes handled by the serveStatic plugin
- Deploy web application firewall rules that block path traversal signatures before requests reach the Node.js process
- Correlate process-level file access telemetry on hosts running restify against expected static content paths
Monitoring Recommendations
- Enable verbose HTTP access logging on all restify services and forward events to a central analytics platform
- Alert on Node.js processes reading files outside their working directory or configured static root
- Track outbound responses whose Content-Length or file path deviates from the whitelisted static asset inventory
How to Mitigate CVE-2026-90494
Immediate Actions Required
- Inventory all applications and services using restify and identify any route that registers the serveStatic plugin
- Restrict or temporarily remove serveStatic routes serving sensitive directories until a patched release is available
- Place a web application firewall or reverse proxy in front of exposed restify endpoints to filter traversal payloads
Patch Information
At the time of publication, the CVE record indicates the vendor did not respond to disclosure and no fixed version is referenced in the NVD entry. Monitor the restify GitHub repository and the VulDB advisory for updated patch information and apply upstream fixes when released.
Workarounds
- Serve static assets through a hardened front-end web server such as nginx or a CDN rather than the restify serveStatic plugin
- Canonicalize and validate request paths in a middleware layer, rejecting any path containing .. segments or encoded equivalents
- Run the Node.js process under a least-privilege account with filesystem access limited to the intended static directory
- Apply WAF signatures blocking common path traversal encodings against restify endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.