CVE-2026-90494 in node-restify

Prediction

by VulDB Data Team • 09/12/2026

A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-403082
• CPE: ready
• CWE: CWE-22 (confirmed)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-90494
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90494
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-90494/