---
id: CVE-2026-16732
aliases:
  - GHSA-3m5p-2c4r-xxw2
title: fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
summary: fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
severity: medium
cvss: 6.1
cwe:
  - CWE-348
vendor: fastify
product: fastify
ecosystem: npm
affected:
  - 'fastify >= 5.8.3, < 5.12.1'
patched:
  - fastify 5.12.1
published: '2026-09-02'
updated: '2026-09-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-3m5p-2c4r-xxw2'
references:
  - url: 'https://github.com/fastify/fastify/security/advisories/GHSA-3m5p-2c4r-xxw2'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16732'
  - url: >-
      https://github.com/fastify/fastify/commit/8acfea7eada05383a7357e3eb21c2628416df280
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/fastify/fastify/releases/tag/v5.12.1'
  - url: 'https://github.com/advisories/GHSA-3m5p-2c4r-xxw2'
tags:
  - ghsa
  - npm
epss: 0.00138
epssPercentile: 0.03541
ingestedAt: '2026-09-02T15:46:29.491Z'
---

## Overview

## Impact

The fix for [CVE-2026-3635](https://www.cve.org/CVERecord?id=CVE-2026-3635) ([GHSA-444r-cwp2-x5xf](https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf)) added a `proxyFn(socket.remoteAddress, 0)` guard on the `X-Forwarded-*` reads in `request.host`, `request.protocol`, `request.hostname`, `request.ip`, and `request.ips`. That guard closes the IP, CIDR, and custom-function forms of `trustProxy` correctly because those forms compile to predicates that inspect the connecting address. The hop-count form (`trustProxy: <number>`) compiles to a predicate that structurally ignores the address argument, so the guard reduces to `0 < tp`, always true for any `tp >= 1`.

Applications configured with `trustProxy: <number>` (documented as "behind N reverse proxies", `trustProxy: 1` being the canonical single-proxy setting) remain vulnerable. An attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the request fields exactly as in the unpatched version. Impact class matches the parent CVE-2026-3635: host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie / CSRF-origin bypass, host-based routing and cache poisoning.

## Patches

Patched in fastify 5.12.1. The numeric form of `trustProxy` is now disabled at runtime and removed from the TypeScript type union.

## Workarounds

- Migrate to an IP / CIDR / custom-function `trustProxy` value that validates the connecting address. Custom functions must inspect the `address` argument, not only the hop index.
- Ensure the Fastify origin is only reachable through the trusted proxy chain (no direct network path).

## Affected packages

- `fastify >= 5.8.3, < 5.12.1`

## Remediation

Upgrade to a patched release:

- `fastify 5.12.1`