Read the docs
TI-2026-13934 Aliases CVE-2026-16732GHSA-3m5p-2c4r-xxw2

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Priority LOW 26CWE-348Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly, because those forms compile to predicates that inspect the connecting address. The hop-count form, where trustProxy is set to a number, compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as trustProxy set to 1 for a single reverse proxy, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact class matches the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. Affected versions are fastify from 5.8.3 up to but not including 5.12.1. Patches: patched in fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. Workarounds: migrate to an IP, CIDR, or custom-function trustProxy value that validates the connecting address, and ensure the Fastify origin is only reachable through the trusted proxy chain.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00158 4th percentileScored 2026-11-07
Fix Partial fastify (fastify): 5.12.1fastify (npm): 5.12.1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastifyfastify5.8.3 to before 5.12.15.12.1Patch availableCNA
—fastify (npm)5.8.3 to before 5.12.15.12.1Patch availableGHSA-3m5p-2c4r-xxw2
  • fastify Vendorfastify Affected 5.8.3 to before 5.12.1 Fixed in 5.12.1 Patch available CNA
  • fastify (npm) Vendor— Affected 5.8.3 to before 5.12.1 Fixed in 5.12.1 Patch available GHSA-3m5p-2c4r-xxw2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*5.8.3 to before 5.12.1Vulnerablefastify
  • cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:* Versions 5.8.3 to before 5.12.1 Vulnerable ·fastify

Remediation

  • Fix · CNA fastify (fastify) Fixed in 5.12.1
  • Fix · GHSA-3m5p-2c4r-xxw2 fastify (npm) Fixed in 5.12.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    fastify 5.12.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-15193 fastify vulnerable to schema validation bypass via root primitive coercion mismatchPriority LOW 24
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Not affected: 2 products
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16732
  2. 2026-10-03 Alias added: GHSA-3m5p-2c4r-xxw2

References

Advisory 3

Other 3

  • TI-2022-18664 Denial of service in Fastify via Content-Type header CVSS 3.1HIGH 7.5
  • TI-2025-23513 Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVSS 3.1HIGH 7.5
  • TI-2026-58050 fastify vulnerable to request validation bypass via skipped boolean false schemas CVSS 3.1HIGH 7.5
  • TI-2026-58022 fastify vulnerable to header validation bypass via incomplete schema case normalization CVSS 3.1HIGH 7.5
  • TI-2026-53284 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVSS 3.1HIGH 7.5
  • TI-2026-26178 fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences