CVE-2026-16732: Fastify X-Forwarded spoofing in trustProxy hop-count

CVE-2026-16732 · Severity: medium · CVSS 6.1 · Published 2026-09-02

Fastify is a popular Node.js web framework that uses the trustProxy setting to safely read X-Forwarded-* headers from proxies. When trustProxy is configured as a number (the most common "behind N reverse proxies" setting), an attacker who can reach the Fastify server directly—bypassing the front-facing proxy—can spoof HTTP headers including the host, protocol, and IP address. This enables host injection attacks, HTTPS-enforcement bypass, and cache poisoning, undermining the security of applications relying on proxy chains.

Technologies: fastify (npm). Vendors: npm.

Quick answers

Is CVE-2026-16732 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16732 being exploited in the wild.
How severe is CVE-2026-16732?
Medium severity, with a CVSS score of 6.1, published 2 September 2026.
Which products and versions are affected?
fastify (npm) >= 5.8.3, < 5.12.1, SEMVER:introduced=5.8.3,fixed=5.12.1.
Is there a fix for CVE-2026-16732?
Yes. fastify (npm): upgrade to 5.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16732 attacked?
It is attacked from the adjacent network.
Am I affected by CVE-2026-16732?
Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastify (npm): upgrade to 5.12.1 or later
    npm install fastify@5.12.1

Technical details

The vulnerability is an incomplete fix to CVE-2026-3635 affecting Fastify versions 5.8.3 through 5.12.0. The previous patch added a guard checking `proxyFn(socket.remoteAddress, 0)` before reading X-Forwarded-* headers in request.host, request.protocol, request.hostname, request.ip, and request.ips. However, the numeric form of trustProxy (e.g., `trustProxy: 1`) compiles to a predicate that ignores the address argument, reducing the guard to `0 < tp`, which is always true for any tp >= 1. An attacker with direct network access to the Fastify origin (bypassing the proxy chain) can exploit this to spoof request metadata exactly as in the unpatched version. The attack requires either adjacent network access or insider access to reach the server directly. Fastify 5.12.1 disables the numeric form of trustProxy at runtime and removes it from the TypeScript type union.

Affected products

  • Fastify fastify >= 5.8.3, < 5.12.1

Identifiers

  • CVE-2026-16732
  • GHSA-3m5p-2c4r-xxw2

Timeline

  • 2026-09-02: disclosed
  • 2026-09-02: patched: Patched in fastify 5.12.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.