# CVE-2026-3635: Fastify request.protocol and request.host spoofing via X-Forwarded headers

Source: https://junglewise.ai/threats/cve-2026-3635-fastify-request-protocol-and-request-host-spoofing-via-x-forwarded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-3635 · Severity: low · CVSS 3.1 · Published 2026-03-25

Fastify, a popular Node.js web framework, contains a vulnerability in how it processes X-Forwarded-Proto and X-Forwarded-Host headers when configured with restrictive proxy trust settings. An attacker can bypass the proxy layer and connect directly to the server, then send spoofed headers to impersonate a legitimate encrypted or cross-domain request. Applications relying on these values for security decisions (enforcing HTTPS, validating cookie flags, or checking request origins) can be tricked into accepting malicious requests.

Technologies: [fastify (npm)](https://junglewise.ai/threats/technologies/fastify). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-3635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3635 being exploited in the wild.

**How severe is CVE-2026-3635?** Low severity, with a CVSS score of 3.1, published 25 March 2026.

**Which products and versions are affected?** fastify (npm) SEMVER:introduced=0,fixed=5.8.3.

**Is there a fix for CVE-2026-3635?** Yes. fastify (npm): upgrade to 5.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3635 attacked?** It is attacked from the adjacent network or over the network, in a software library.

**Am I affected by CVE-2026-3635?** Check whether you run fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fastify (npm): upgrade to 5.8.3 or later

  ```sh
  npm install fastify@5.8.3
  ```


## Technical details

This vulnerability exists in the request.protocol and request.host getters within Fastify's request handling logic. When trustProxy is configured with a restrictive trust function (such as a specific IP, subnet, hop count, or custom validation function), the code still reads X-Forwarded-Proto and X-Forwarded-Host headers from connections originating from untrusted IPs. An attacker can establish a direct network connection to the Fastify server (bypassing any reverse proxy) and inject these headers to spoof the protocol (HTTP vs HTTPS) and hostname. The vulnerability is specific to restrictive trust configurations; the insecure behavior does not occur when trustProxy is set to a blanket trust mode. Applications using these request properties for security-critical decisions—HTTPS enforcement, secure cookie flag validation, CSRF token origin checks, or URL construction—are vulnerable. The issue was patched in Fastify version 5.8.3.

## Affected products

- Fastify fastify <= 5.8.2

## Identifiers

- CVE-2026-3635
- GHSA-444r-cwp2-x5xf

## Timeline

- 2026-03-23: disclosed
- 2026-03-23: patched: Version 5.8.3 released on 2026-03-23

## References

- [https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf](https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf)
- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fastify](https://github.com/fastify/fastify)
- [https://github.com/fastify/fastify/releases/tag/v5.8.3](https://github.com/fastify/fastify/releases/tag/v5.8.3)
- [https://www.cve.org/CVERecord?id=CVE-2026-3635](https://www.cve.org/CVERecord?id=CVE-2026-3635)

## Related threats

- [fastify is vulnerable to header validation bypass via case-sensitive propertyNames](https://junglewise.ai/threats/cve-2026-107832-fastify-is-a-fast-and-low-overhead-web-framework-for-node-js-in)
- [Fastify denial of service via unhandled exception on HTTP/2 trailer responses](https://junglewise.ai/threats/cve-2026-92081-fastify-denial-of-service-via-unhandled-exception-on-http-2)
- [Fastify header validation bypass via incomplete schema case normalization](https://junglewise.ai/threats/cve-2026-84428-fastify-header-validation-bypass-via-incomplete-schema-case)
- [Fastify request body replacement via async validation result collision](https://junglewise.ai/threats/cve-2026-84504-fastify-request-body-replacement-via-async-validation-result)
- [Fastify request validation bypass via skipped boolean false schemas](https://junglewise.ai/threats/cve-2026-84469-fastify-request-validation-bypass-via-skipped-boolean-false)