GHSA-3m5p-2c4r-xxw2 CVE-2026-16732

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Medium npm

Severity: 6.1 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.16%; Chance of exploitation in the next 30 days. Higher than 4.90% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-348 Use of Less Trusted Source
Fix: 5.12.1; Upgrade fastify to this version or later

Description

Impact

The fix for CVE-2026-3635 (GHSA-444r-cwp2-x5xf) added a proxyFn(socket.remoteAddress, 0) guard on the X-Forwarded-* reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (trustProxy: <number>) compiles to a predicate that structurally ignores the address argument, so the guard reduces to 0 < tp, always true for any tp >= 1.

Applications configured with trustProxy: <number> (documented as "behind N reverse proxies", trustProxy: 1 being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.

Patches

Patched in fastify 5.12.1. The numeric form of trustProxy is now disabled at runtime and removed from the TypeScript type union.

Workarounds

Migrate to an IP / CIDR / custom-function trustProxy value that validates the connecting address. Custom functions must inspect the address argument, not only the hop index.
Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).

Affected versions

npm

Package	Vulnerable	Fixed in
fastify	`>= 5.8.3, < 5.12.1`	`5.12.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

fastify npm → `5.12.1`

npm

npm install fastify@5.12.1

yarn

yarn add fastify@5.12.1

pnpm

pnpm add fastify@5.12.1

Severity breakdown

CVSS 3.1 6.1

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack vector: Adjacent
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-348: Use of Less Trusted Source

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-16732

Packages

github.com/fastify/fastify

Timeline

Aug 18, 2026 Published
Sep 2, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-389g-gv7q-r4x8 fastify is vulnerable to header validation bypass via case-sensitive propertyNames	Low	Also affects fastify
GHSA-4mh8-r7rc-xpvc fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses	Medium	Also affects fastify
GHSA-9q9j-q6p8-xq58 fastify vulnerable to header validation bypass via incomplete schema case normalization	High	Also affects fastify
GHSA-667r-xxjv-c9mm fastify vulnerable to request body replacement via an async validation result collision	High	Also affects fastify
GHSA-hwr6-493r-vm6h fastify vulnerable to request validation bypass via skipped boolean false schemas	High	Also affects fastify
GHSA-p68q-wchp-6fh7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers	High	Also affects fastify
GHSA-w2qp-rph6-63g4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch	Medium	Also affects fastify
GHSA-444r-cwp2-x5xf fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections	Medium	Also affects fastify

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor