Executive brief
fastify-cli is a command-line tool for the Fastify web framework that includes a Node.js debugging mode. When debug mode is enabled with an explicit bind address, a logic error causes the debugger to ignore the specified address and bind to all network interfaces (0.0.0.0) instead. Since the Node.js Inspector protocol allows unauthenticated code execution, an attacker on the network can connect to the exposed debugger and execute arbitrary code on the developer's machine.
Technical details
The vulnerability is a logical operator precedence flaw in the host selection code. Due to incorrect parenthesization of a conditional expression, the logical OR operator binds tighter than the ternary operator, causing any explicit --debug-host value (including restrictive addresses like 127.0.0.1) to be replaced with 0.0.0.0. This exposes the Node Inspector to all network interfaces. The Node Inspector is an unauthenticated Chrome DevTools Protocol endpoint that allows arbitrary JavaScript and OS command execution. Exploitation requires debug mode to be enabled with an explicit --debug-host flag and the Inspector port to be network-reachable. The vulnerability affects fastify-cli versions 1.5.0 through 8.0.0 and is fixed in 8.0.1.
Affected products
- Fastify fastify-cli 1.5.0 to 8.0.0
Timeline
- 2026-09-08: disclosed: CVE-2026-75021 published
- 2026-09-08: patched: Fixed in fastify-cli 8.0.1