Executive brief
@fastify/forwarded is a utility library used by the Fastify web framework to identify the original IP address of a user connecting through a proxy. A flaw in how the library handles web headers allows attackers to bypass security controls like IP-based blocklists or rate limits by inserting a hidden tab character. While this does not allow an attacker to impersonate a trusted internal server, it can be used to evade restrictions intended to block malicious traffic or prevent automated abuse.
Technical details
The vulnerability is an improper input validation issue (CWE-20) within the X-Forwarded-For header parser. While RFC 7230 defines optional whitespace as both spaces and horizontal tabs, @fastify/forwarded versions prior to 3.0.2 only trimmed space characters. An attacker can inject a horizontal tab (\t) before their IP address in the header, causing the library to resolve a string containing the literal tab (e.g., '\t1.2.3.4'). Because security mechanisms like rate limiters or IP allowlists typically perform exact string matches, the corrupted string will fail to match the expected IP, effectively evading the check. This issue is resolved in version 3.0.2.
Affected products
- Fastify @fastify/forwarded < 3.0.2
Timeline
- 2026-07-28: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: NVD publication date
- 2026-07-29: patched: Fix released in version 3.0.2