Executive brief
Fastify is a popular Node.js web framework that uses the trustProxy setting to safely read X-Forwarded-* headers from proxies. When trustProxy is configured as a number (the most common "behind N reverse proxies" setting), an attacker who can reach the Fastify server directly—bypassing the front-facing proxy—can spoof HTTP headers including the host, protocol, and IP address. This enables host injection attacks, HTTPS-enforcement bypass, and cache poisoning, undermining the security of applications relying on proxy chains.
Technical details
The vulnerability is an incomplete fix to CVE-2026-3635 affecting Fastify versions 5.8.3 through 5.12.0. The previous patch added a guard checking `proxyFn(socket.remoteAddress, 0)` before reading X-Forwarded-* headers in request.host, request.protocol, request.hostname, request.ip, and request.ips. However, the numeric form of trustProxy (e.g., `trustProxy: 1`) compiles to a predicate that ignores the address argument, reducing the guard to `0 < tp`, which is always true for any tp >= 1. An attacker with direct network access to the Fastify origin (bypassing the proxy chain) can exploit this to spoof request metadata exactly as in the unpatched version. The attack requires either adjacent network access or insider access to reach the server directly. Fastify 5.12.1 disables the numeric form of trustProxy at runtime and removes it from the TypeScript type union.
Affected products
- Fastify fastify >= 5.8.3, < 5.12.1
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Patched in fastify 5.12.1