CVE-2026-16732

Fastify 5.8.3–5.12.0 remains vulnerable to X-Forwarded-* spoofing when trustProxy is set numerically (e.g., 1), because the CVE-2026-3635 guard predicate ignores the connecting address. This enables host injection, HTTPS-enforcement bypass, secure-cookie/CSRF-origin bypass, and cache poisoning. P...

CVE-2026-16732 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...