fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
Impact
The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a proxyFn(socket.remoteAddress, 0) guard on the X-Forwarded-* reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (trustProxy: <number>) compiles to a predicate that structurally ignores the address argument, so the guard reduces to 0 < tp, always true for any tp >= 1.
Applications configured with trustProxy: <number> (documented as "behind N reverse proxies", trustProxy: 1 being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.
Patches
Patched in fastify 5.12.1. The numeric form of trustProxy is now disabled at runtime and removed from the TypeScript type union.
Workarounds
- Migrate to an IP / CIDR / custom-function
trustProxyvalue that validates the connecting address. Custom functions must inspect theaddressargument, not only the hop index. - Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | fastify | >= 5.8.3, < 5.12.1 | 5.12.1 |
References
- https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2
- https://nvd.nist.gov/vuln/detail/CVE-2026-16732
- https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fastify
- https://github.com/fastify/fastify/releases/tag/v5.12.1
- CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N- Weakness (CWE)
CWE-348- Platform
- npm
- Package
fastify- Disclosed
- 02.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-3m5p-2c4r-xxw2 - CC BY 4.0
Vulnerability history: fastify
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 16
- First → latest
- 07.2018 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 8
- Medium 7
- Low 1
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 11
-
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.