EUVD-2026-61222Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attacker must bypass the proxy and reach the adjacent origin (AV:A/AC:H); CSRF-origin and secure-cookie bypass introduce partial integrity impact (I:L) beyond the official I:N.
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly, because those forms compile to predicates that inspect the connecting address. The hop-count form, where trustProxy is set to a number, compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as trustProxy set to 1 for a single reverse proxy, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact class matches the parent CVE-2026-3635, including host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning. Affected versions are fastify from 5.8.3 up to but not including 5.12.1. Patches: patched in fastify 5.12.1, where the numeric form of trustProxy is disabled at runtime and removed from the TypeScript type union. Workarounds: migrate to an IP, CIDR, or custom-function trustProxy value that validates the connecting address, and ensure the Fastify origin is only reachable through the trusted proxy chain.
AnalysisAI
Header spoofing in fastify 5.8.3 through 5.12.0 persists despite the prior CVE-2026-3635 patch because the numeric trustProxy form compiles to a hop-count predicate that structurally ignores the connecting address, rendering the guard introduced by the earlier fix completely ineffective for this configuration. An attacker who can reach the Fastify origin server directly - bypassing the front-facing reverse proxy - can forge X-Forwarded-For, X-Forwarded-Host, and related fields that fastify uses to derive request.ip, request.hostname, request.host, and request.protocol, enabling host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin spoofing, and host-based routing and cache poisoning. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to align simultaneously: the target application must be configured with a numeric trustProxy value (any positive integer such as trustProxy: 1, 2, or higher), and the attacker must be able to establish a direct TCP connection to the Fastify origin server, bypassing the front-facing reverse proxy. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 6.1 score (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects an adjacent-network, high-complexity attack with changed scope and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to fastify 5.12.1, which disables the numeric trustProxy form at runtime and removes it from the TypeScript type union, eliminating the vulnerable predicate entirely. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-348 – Use of Less Trusted Source
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today