{"id":"CVE-2026-16732","aliases":["GHSA-3m5p-2c4r-xxw2"],"title":"fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count","summary":"fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count","severity":"medium","cvss":6.1,"cwe":["CWE-348"],"vendor":"fastify","product":"fastify","ecosystem":"npm","affected":["fastify >= 5.8.3, < 5.12.1"],"patched":["fastify 5.12.1"],"published":"2026-09-02","updated":"2026-09-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-3m5p-2c4r-xxw2","references":[{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16732"},{"url":"https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fastify/releases/tag/v5.12.1"},{"url":"https://github.com/advisories/GHSA-3m5p-2c4r-xxw2"}],"tags":["ghsa","npm"],"epss":0.00138,"epssPercentile":0.03531,"ingestedAt":"2026-09-02T15:46:29.491Z","slug":"CVE-2026-16732","body":"## Overview\n\n## Impact\n\nThe fix for [CVE-2026-3635](https://www.cve.org/CVERecord?id=CVE-2026-3635) ([GHSA-444r-cwp2-x5xf](https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf)) added a `proxyFn(socket.remoteAddress, 0)` guard on the `X-Forwarded-*` reads in `request.host`, `request.protocol`, `request.hostname`, `request.ip`, and `request.ips`. That guard closes the IP, CIDR, and custom-function forms of `trustProxy` correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (`trustProxy: <number>`) compiles to a predicate that structurally ignores the address argument, so the guard reduces to `0 < tp`, always true for any `tp >= 1`.\n\nApplications configured with `trustProxy: <number>` (documented as \"behind N reverse proxies\", `trustProxy: 1` being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.\n\n## Patches\n\nPatched in fastify 5.12.1. The numeric form of `trustProxy` is now disabled at runtime and removed from the TypeScript type union.\n\n## Workarounds\n\n- Migrate to an IP / CIDR / custom-function `trustProxy` value that validates the connecting address. Custom functions must inspect the `address` argument, not only the hop index.\n- Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).\n\n## Affected packages\n\n- `fastify >= 5.8.3, < 5.12.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `fastify 5.12.1`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}