EUVD-2026-14431
GHSA-444r-cwp2-x5xf
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V6 - Authentication IP-independent access control
|
| Impact | The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates adjacent attack vector (attacker must be on local network or have routing capability to reach the Fastify instance), high attack complexity (requires specific configuration to be vulnerable), no privilege requirement, and high confidentiality impact across scope boundaries. This moderate CVSS score of 6.1 is supported by the attack complexity and vector constraints; however, real-world risk depends critically on deployment topology. Applications where Fastify listens only behind a trusted reverse proxy face minimal risk, while applications exposed directly to untrusted networks or in shared hosting environments face significantly higher risk. The vulnerability requires either direct network access to the Fastify port or a routing bypass of the proxy layer, making opportunistic internet-wide exploitation unlikely but targeted exploitation against specific infrastructure moderately feasible. The configuration requirement (restrictive trustProxy setting) means default or permissive deployments are unaffected, and patch availability from the OpenJS foundation security advisories should facilitate rapid remediation. |
| Exploit ScenarioDerived | An attacker with network access to a Fastify application (either through direct exposure or by compromising the local network) connects directly to the Fastify port, bypassing an intended reverse proxy. The attacker sends an HTTP request with crafted X-Forwarded-Proto: https and X-Forwarded-Host: trusted-domain.com headers. Because trustProxy is set to a restrictive value (e.g., trust only 10.0.0.1), the application code expects the headers to be untrustworthy; however, due to the vulnerability, request.protocol and request.host return the spoofed values. If the application uses these values to decide whether to set the secure flag on session cookies or to validate CSRF origin headers, the attacker can bypass these protections. The high attack complexity reflects the requirement for direct network access and specific configuration, but the attack is deterministic once these preconditions are met. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
Fastify versions 5.8.2 and earlier contain a header spoofing vulnerability in the trustProxy implementation where the request.protocol and request.host getters incorrectly trust X-Forwarded-Proto and X-Forwarded-Host headers even from untrusted connections when a restrictive trust function is configured. An attacker who can connect directly to a Fastify instance (bypassing the intended proxy) can spoof protocol and host values, potentially bypassing HTTPS enforcement, manipulating secure cookie behavior, and defeating CSRF origin checks. This vulnerability affects applications relying on these headers for security decisions and has a CVSS score of 6.1 with adjacent attack vector and high complexity, indicating moderate real-world exploitability.
RemediationAI
Upgrade Fastify to a patched version newer than 5.8.2 immediately, as fixes have been released by the Fastify project (see https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf). Until patching is completed, apply network-level mitigations by ensuring Fastify listens only on loopback interfaces (127.0.0.1 or ::1) or behind a trusted reverse proxy with strict ingress controls; restrict network access via firewall rules to only trusted proxy servers and reject direct connections from untrusted sources. Additionally, validate the trustProxy configuration to confirm it matches your deployment topology and review application code that depends on request.protocol and request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF checks, host-based routing) to add defense-in-depth validation layers that do not rely solely on these potentially-spoofed headers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fastify is a Node.js web framework (CPE: cpe:2.3:a:fastify:fastify:*:*:*:*:*:*:*:*) that implements HTTP request handling with configurable trust models for reverse proxy scenarios. The trustProxy configuration option controls which headers are trusted from forwarding intermediaries; when set to a restrictive value such as a specific IP address, subnet, or custom validation function, it should enforce that only connections from trusted sources can influence request metadata. This vulnerability falls under CWE-348 (Misrepresentation of Requested Origin in Input). The root cause is that the request.protocol and request.host property getters bypass the configured trust logic and read X-Forwarded-Proto and X-Forwarded-Host headers unconditionally, allowing a direct attacker to inject false values that the application interprets as legitimate proxy-supplied metadata.
Know when Fastify gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection - including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.
Affected Versions fastify <= 5.8.2
Impact Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.
When trustProxy: true (trust everything), both host and protocol trust all forwarded headers - this is expected behavior. The vulnerability only manifests with restrictive trust configurations.
Blast Radius
ecosystem impact- 38 npm packages depend on fastify (13 direct, 25 indirect)
Ecosystem-wide dependent count for version 5.8.3.
Executive ViewAI
Organizations using Summary When trustProxy should be aware of moderate risk from CVE-2026-3635 rated CVSS 6.1. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all req
A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect
Fastify is a fast and low overhead web framework, for Node.js. Rated high severity (CVSS 7.5), this vulnerability is rem
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: a
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger reso
A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbit
Authorization bypass in the @fastify/express middleware-compatibility plugin (versions 4.0.6 and earlier) lets unauthent
Authentication bypass in @fastify/express v4.0.4 and earlier allows remote unauthenticated attackers to access protected
Middleware bypass in Fastify Express plugin (fastify/express) allows complete circumvention of authentication, authoriza
Fastify is a web framework with minimal overhead and plugin architecture. Rated high severity (CVSS 8.8), this vulnerabi
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Exploit-DB