Spoofing Vulnerability in Fastify Framework by Fastify Team

CVE-2026-3635

What is CVE-2026-3635?

A vulnerability exists in the Fastify framework where the trustProxy configuration can be manipulated. When configured restrictively (e.g., specific IP restrictions), the request.protocol and request.host getters may expose the application to spoofing attacks. Attackers can bypass proxies and directly connect to the application, allowing them to craft requests with forged protocol and host values. This could compromise security mechanisms that depend on these values for critical decisions such as HTTPS enforcement and CSRF protection. It is crucial for users of affected versions to review their trustProxy settings and implement necessary mitigations.

References