Fastify Cli
Monthly
Remote code execution is possible in fastify-cli 1.5.0 through 8.0.0 when the Node.js Inspector is activated via a debug flag: the CLI ignores the user-supplied bind address and instead binds the Inspector to an overly broad network interface, exposing it beyond the local loopback. Because the Node.js Inspector protocol (Chrome DevTools Protocol) permits unrestricted JavaScript evaluation, any remote party that can reach the exposed Inspector port gains full code execution on the developer's machine with no authentication required. No public exploit code has been identified at time of analysis, and the EPSS signal is not provided, but the Inspector protocol itself is well-understood and trivially exploitable once the port is reachable.
Remote code execution is possible in fastify-cli 1.5.0 through 8.0.0 when the Node.js Inspector is activated via a debug flag: the CLI ignores the user-supplied bind address and instead binds the Inspector to an overly broad network interface, exposing it beyond the local loopback. Because the Node.js Inspector protocol (Chrome DevTools Protocol) permits unrestricted JavaScript evaluation, any remote party that can reach the exposed Inspector port gains full code execution on the developer's machine with no authentication required. No public exploit code has been identified at time of analysis, and the EPSS signal is not provided, but the Inspector protocol itself is well-understood and trivially exploitable once the port is reachable.