fastify CVE-2026-16732

Exploitation requires two specific conditions to align simultaneously: the target application must be configured with a numeric trustProxy value (any positive integer such as trustProxy: 1, 2, or higher), and the attacker must be able to establish a direct TCP connection to the Fastify origin server, bypassing the front-facing reverse proxy. Applications using trustProxy set to an IP address string, CIDR block, or custom validation function are not affected by this regression. No authentication, user interaction, or elevated privilege is required on the attacker's part - only network reachability to the origin. The principal factor limiting exploitation in practice is network isolation: if the origin server is properly confined behind the proxy with no direct external or internal access path, the attack surface is substantially reduced even without an application-level fix. Fastify versions prior to 5.8.3 (before the incomplete CVE-2026-3635 patch was introduced) and versions 5.12.1 and later (where the numeric form is disabled) are not affected.

The official CVSS 6.1 score (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects an adjacent-network, high-complexity attack with changed scope and high confidentiality impact. The adjacent vector assumes the Fastify origin is isolated from direct internet access, which is the primary real-world constraint on exploitability; if the origin is reachable from the internet without network-level controls, the effective attack complexity drops substantially. No EPSS score was supplied in the source data, and this vulnerability is not currently listed in the CISA KEV catalog; no public exploit code has been identified. The moderate CVSS score may understate operational risk for applications that use the derived IP, host, or protocol values in security-sensitive decisions - CSRF validation, secure-cookie scope enforcement, HTTPS-redirect logic, and host-based routing are all affected impact classes explicitly named in the advisory. Even a mid-sized municipal IT team in bytom running a fastify-backed API gateway behind a load balancer with trustProxy: 1 should treat this as an urgent configuration review, since the regression specifically affects the most common single-proxy numeric setting. The vulnerability is compounded by its nature as an incomplete fix: teams who applied the CVE-2026-3635 patch may incorrectly believe they are fully remediated, making discovery through routine scanning less likely.

An attacker determines that a target's Fastify origin server is directly reachable - for example, via an exposed port in a misconfigured cloud security group or an internal network route that bypasses the reverse proxy - and confirms from a public source or reconnaissance that the application uses a numeric trustProxy setting. The attacker sends an HTTP request directly to the origin with a crafted X-Forwarded-For header containing a trusted IP and a spoofed X-Forwarded-Host header pointing to an attacker-controlled domain; because the hop-count predicate unconditionally satisfies the trust guard, fastify accepts these values and derives host, protocol, and IP from attacker-supplied data. The attacker then exploits the injected host value to poison host-based cache entries, forge CSRF-origin checks, suppress HTTPS enforcement, or redirect generated URLs to an attacker-controlled endpoint.