EUVD-2026-50332Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-exploitable via HTTP headers, no privileges or interaction required; integrity-only impact limited to security control bypass, no confidentiality or availability effect.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both space and tab. As a result, an entry padded with a tab keeps the literal tab in the resolved address string. Applications that make exact string match security decisions on the resolved client IP, such as an allowlist, a blocklist, a per IP rate limit key, or audit log correlation, can be evaded because the tab corrupted string no longer matches the expected value. This does not cross the trust boundary, since a tab corrupted string is not a valid IP and cannot be mistaken for a trusted proxy. The issue is fixed in @fastify/forwarded 3.0.2.
AnalysisAI
IP-based security controls in applications using @fastify/forwarded before 3.0.2 can be bypassed by injecting a horizontal tab character into X-Forwarded-For header entries. The parser strips only space characters during whitespace normalization, violating RFC 7230's definition of optional whitespace (which includes both SP and HTAB), causing the resolved IP string to carry a trailing tab. Any application performing exact-string security decisions on the resolved address - allowlists, blocklists, per-IP rate limit keys, or audit log correlation - will silently fail to match the expected value, allowing an attacker to evade those controls. No public exploit has been identified at time of analysis, and no KEV listing exists; however, exploitation requires no authentication or special configuration beyond controlling HTTP request headers.
Technical ContextAI
The @fastify/forwarded npm package implements client IP resolution by parsing the X-Forwarded-For HTTP header, splitting on commas, and trimming surrounding whitespace from each entry. RFC 7230 Section 3.2.3 defines optional whitespace (OWS) as a sequence of SP (0x20) or HTAB (0x09) characters, meaning compliant parsers must strip both. The affected versions exclusively trim space characters, leaving horizontal tab (0x09) embedded in the resolved address string. The affected component is identified by CPE cpe:2.3:a:@fastify/forwarded:@fastify/forwarded:*:*:*:*:*:*:*:* and is part of the Fastify ecosystem, used when Fastify's trustProxy feature delegates to this library for address resolution. The root cause maps to CWE-20 (Improper Input Validation): the whitespace normalization routine is incomplete relative to the RFC specification, producing a non-canonical output that downstream consumers treat as a distinct, unrecognized value.
RemediationAI
Upgrade @fastify/forwarded to version 3.0.2 or later, which corrects the whitespace normalization to strip both SP and HTAB characters per RFC 7230. The vendor advisory is at https://github.com/fastify/forwarded/security/advisories/GHSA-2849-m2w7-xm8f. If an immediate upgrade is not possible, a compensating control is to validate the resolved IP string as a syntactically valid IPv4 or IPv6 address before using it in security decisions - a tab-corrupted string will fail strict IP format validation and can be rejected or logged as anomalous. Additionally, applications may configure upstream reverse proxies (nginx, HAProxy, etc.) to normalize or strip the X-Forwarded-For header before it reaches the Fastify application, removing attacker-supplied whitespace at the network boundary. The trade-off of the proxy-normalization approach is added operational complexity and a dependency on consistent proxy configuration across all ingress paths.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today