Executive brief
Fastify, a popular Node.js web framework, contains a vulnerability in how it processes X-Forwarded-Proto and X-Forwarded-Host headers when configured with restrictive proxy trust settings. An attacker can bypass the proxy layer and connect directly to the server, then send spoofed headers to impersonate a legitimate encrypted or cross-domain request. Applications relying on these values for security decisions (enforcing HTTPS, validating cookie flags, or checking request origins) can be tricked into accepting malicious requests.
Technical details
This vulnerability exists in the request.protocol and request.host getters within Fastify's request handling logic. When trustProxy is configured with a restrictive trust function (such as a specific IP, subnet, hop count, or custom validation function), the code still reads X-Forwarded-Proto and X-Forwarded-Host headers from connections originating from untrusted IPs. An attacker can establish a direct network connection to the Fastify server (bypassing any reverse proxy) and inject these headers to spoof the protocol (HTTP vs HTTPS) and hostname. The vulnerability is specific to restrictive trust configurations; the insecure behavior does not occur when trustProxy is set to a blanket trust mode. Applications using these request properties for security-critical decisions—HTTPS enforcement, secure cookie flag validation, CSRF token origin checks, or URL construction—are vulnerable. The issue was patched in Fastify version 5.8.3.
Affected products
- Fastify fastify <= 5.8.2
Timeline
- 2026-03-23: disclosed
- 2026-03-23: patched: Version 5.8.3 released on 2026-03-23