---
id: CVE-2026-75021
title: >-
  fastify-cli starts the Node.js Inspector when a debug flag is used, but it
  ignores the explicit bind address the user supplies and binds the Inspector to
  a broadly reachable address instead of the intended loopback
summary: >-
  fastify-cli starts the Node.js Inspector when a debug flag is used, but it
  ignores the explicit bind address the user supplies and binds the Inspector to
  a broadly reachable address instead of the intended loopback. As a result the
  debug…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1327
vendor: fastify-cli
product: fastify-cli
affected:
  - fastify-cli >= 1.5.0 < 8.0.1
published: '2026-09-08'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:07:52.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75021'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://github.com/fastify/fastify-cli/security/advisories/GHSA-88v4-3ph7-r88m
    label: ce714d77-add3-4f53-aff5-83d477b104bb
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-08T14:21:00.762047Z'
ingestedAt: '2026-09-08T15:33:26.984Z'
epss: 0.00705
epssPercentile: 0.51354
---

## Overview

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.