Is CVE-2026-75021 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75021 being exploited in the wild.

How severe is CVE-2026-75021?

High severity, with a CVSS score of 8.1, published 8 September 2026.

Is there a fix for CVE-2026-75021?

A patch was published on 2026-09-08: Fixed in fastify-cli 8.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75021 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75021?

Check whether you run Fastify-Cli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75021: fastify-cli remote code execution via ignored Inspector bind address

CVE-2026-75021 · Severity: high · CVSS 8.1 · Published 2026-09-08

fastify-cli is a command-line tool for the Fastify web framework that includes a Node.js debugging mode. When debug mode is enabled with an explicit bind address, a logic error causes the debugger to ignore the specified address and bind to all network interfaces (0.0.0.0) instead. Since the Node.js Inspector protocol allows unauthenticated code execution, an attacker on the network can connect to the exposed debugger and execute arbitrary code on the developer's machine.

Vendors: Fastify.

Quick answers

Is CVE-2026-75021 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75021 being exploited in the wild.
How severe is CVE-2026-75021?: High severity, with a CVSS score of 8.1, published 8 September 2026.
Which products and versions are affected?: Fastify-Cli 1.5.0 to 8.0.0.
Is there a fix for CVE-2026-75021?: A patch was published on 2026-09-08: Fixed in fastify-cli 8.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75021 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75021?: Check whether you run Fastify-Cli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a logical operator precedence flaw in the host selection code. Due to incorrect parenthesization of a conditional expression, the logical OR operator binds tighter than the ternary operator, causing any explicit --debug-host value (including restrictive addresses like 127.0.0.1) to be replaced with 0.0.0.0. This exposes the Node Inspector to all network interfaces. The Node Inspector is an unauthenticated Chrome DevTools Protocol endpoint that allows arbitrary JavaScript and OS command execution. Exploitation requires debug mode to be enabled with an explicit --debug-host flag and the Inspector port to be network-reachable. The vulnerability affects fastify-cli versions 1.5.0 through 8.0.0 and is fixed in 8.0.1.

Affected products

Fastify fastify-cli 1.5.0 to 8.0.0

Timeline

2026-09-08: disclosed: CVE-2026-75021 published
2026-09-08: patched: Fixed in fastify-cli 8.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.