Web Framework Vulnerability in Fastify by Node.js

CVE-2026-16732

What is CVE-2026-16732?

Fastify, a popular web framework for Node.js, has a vulnerability that allows an attacker to bypass protections when using a numeric trustProxy setting. Specifically, configurations that set trustProxy to a numeric value like 1 allow unauthorized users to spoof forwarded request fields, leading to potential host injection in URLs, HTTPS enforcement bypasses, and CSRF-origin vulnerabilities. While the protector introduced in a previous patch addresses most trustProxy forms, the numeric form remains exploitable, allowing a direct connection to Fastify, which poses significant security risks. The issue affects Fastify versions from 5.8.3 up to, but not including, 5.12.1, which has addressed this vulnerability by disabling the numeric trustProxy at runtime.

References