{"id":"GHSA-3m5p-2c4r-xxw2","summary":"fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count","details":"## Impact\n\nThe fix for [CVE-2026-3635](https://www.cve.org/CVERecord?id=CVE-2026-3635) ([GHSA-444r-cwp2-x5xf](https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf)) added a `proxyFn(socket.remoteAddress, 0)` guard on the `X-Forwarded-*` reads in `request.host`, `request.protocol`, `request.hostname`, `request.ip`, and `request.ips`. That guard closes the IP, CIDR, and custom-function forms of `trustProxy` correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (`trustProxy: \u003cnumber\u003e`) compiles to a predicate that structurally ignores the address argument, so the guard reduces to `0 \u003c tp`, always true for any `tp \u003e= 1`.\n\nApplications configured with `trustProxy: \u003cnumber\u003e` (documented as \"behind N reverse proxies\", `trustProxy: 1` being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.\n\n## Patches\n\nPatched in fastify 5.12.1. The numeric form of `trustProxy` is now disabled at runtime and removed from the TypeScript type union.\n\n## Workarounds\n\n- Migrate to an IP / CIDR / custom-function `trustProxy` value that validates the connecting address. Custom functions must inspect the `address` argument, not only the hop index.\n- Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).","aliases":["CVE-2026-16732"],"modified":"2026-09-02T15:30:05.186561518Z","published":"2026-09-02T15:14:06Z","database_specific":{"cwe_ids":["CWE-348"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-02T15:14:06Z","nvd_published_at":"2026-08-18T21:16:34Z"},"references":[{"type":"WEB","url":"https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16732"},{"type":"WEB","url":"https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/fastify/fastify"},{"type":"WEB","url":"https://github.com/fastify/fastify/releases/tag/v5.12.1"}],"affected":[{"package":{"name":"fastify","ecosystem":"npm","purl":"pkg:npm/fastify"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.8.3"},{"fixed":"5.12.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3m5p-2c4r-xxw2/GHSA-3m5p-2c4r-xxw2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}