fastify-cli CVE-2026-75021

Exploitation requires two simultaneous conditions: (1) fastify-cli must be invoked with a debug or inspect flag by the developer - this is a non-default, explicit user action and does not affect production deployments that omit the flag; (2) the Node.js Inspector port (default TCP 9229, or a user-specified port that is nonetheless bound broadly) must be network-reachable from the attacker, which does not occur by default on properly firewalled local workstations. The vulnerability is therefore limited to scenarios such as cloud-hosted dev boxes, shared team servers running debug sessions, Docker/container environments with exposed ports, and CI pipelines using debug mode with accessible runners. Standard production deployments of fastify-cli without debug flags are entirely unaffected. No authentication is required against the Inspector once reachable - that is the nature of the Node.js Inspector protocol.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 8.1. The AC:H reflects that exploitation is not trivially achievable against arbitrary targets: the victim must be actively running fastify-cli with a debug flag, and the attacker must have network-level reachability to the Inspector port (typically TCP 9229). In practice this primarily threatens developers running debug sessions on machines that are network-accessible - shared development servers, cloud-hosted dev environments, Docker containers with exposed ports, or CI/CD runners with debug flags left enabled. No public exploit has been identified and the CVE is not in the CISA KEV catalog, reducing urgency for production defenders. However, the impact is maximal once conditions are met: the Inspector protocol requires no credentials and directly yields RCE. SSVC framing: exploitation is 'none' currently but the technical impact is 'total' and the attack is automatable given reachability, making this a genuine priority for teams running fastify-cli in shared or cloud-hosted development environments. The scope (S:U) correctly reflects that compromise stays within the developer's Node.js process, though OS-level lateral movement is trivial from that point.

A developer running 'fastify-cli start --debug' on a cloud-hosted development instance or a Docker container with port 9229 forwarded inadvertently exposes the Node.js Inspector to the internet. An attacker scans for TCP 9229, connects via WebSocket to the Inspector endpoint, and executes a Runtime.evaluate call with a Node.js child_process.exec payload, achieving arbitrary OS command execution as the developer's user account.