A path traversal vulnerability exists in the serveStatic function within /lib/plugins/static.js of restify node-restify versions up to 12.0.0. This flaw allows remote attackers to manipulate file paths to access files outside the intended directory. The vendor did not respond to disclosure attempts, and no patch information is available. The CVSS 4.0 vector indicates the attack is network accessible, requires no privileges or user interaction, and has low impact on confidentiality.

The vulnerability enables remote attackers to perform path traversal, potentially accessing files outside the intended static directory. This could lead to unauthorized disclosure of sensitive files. However, the impact on confidentiality is rated low, and there is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official restify channels for updates. Until a fix is released, consider restricting access to static file serving or implementing additional validation on file paths to mitigate exploitation risk.