CVE-2026-90494

Name of the Vulnerable Software and Affected Versions restify node-restify versions prior to 12.0.1

Description A remote path traversal flaw exists in the serveStatic() function within the /lib/plugins/static.js library. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the serveStatic() function.