CVE-2026-90494
A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Published Sep 13, 2026
- CVSS 6.9 medium
- 0.8% chance of exploitation in the next 30 days (EPSS)
- No fix is known yet