Remote Code Execution Vulnerability in fastify-cli by Fastify
CVE-2026-75021

8.1HIGH

Key Information:

Vendor

Fastify-cli

Status
Fastify-cli
Vendor
CVE Published:
8 September 2026

What is CVE-2026-75021?

A significant security issue has been identified in fastify-cli, which can lead to remote code execution. When the debug flag is activated, the Node.js Inspector binds to a potentially accessible network address instead of the secure loopback interface. This misconfiguration allows unauthorized access to the debugging interface, giving malicious actors the ability to execute arbitrary code on a developer's machine. It is crucial for users operating fastify-cli versions between 1.5.0 and 8.0.1 to upgrade to version 8.0.1 to ensure that the Inspector correctly honors the specified bind address, thereby safeguarding against these vulnerabilities.

Affected Version(s)

fastify-cli 1.5.0 < 8.0.1

fastify-cli 8.0.1

References

https://github.com/fastify/fastify-cli/security/advisorie...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Universe-Theori
mcollina
UlisesGascon
.