PT-2026-27132 · Fastify · Fastify
Kaka
+3
·
Publicado
2026-03-23
·
Atualizado
2026-03-25
·
CVE-2026-3635
CVSS v3.1
6.1
Média
| Vetor | AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
fastify versions through 5.8.2
Description
When the
trustProxy setting is configured with a restrictive trust function—such as a specific IP address, a subnet, a hop count, or a custom function—the request.protocol and request.host getters incorrectly read X-Forwarded-Proto and X-Forwarded-Host headers from all connections, including those from untrusted sources. This allows an attacker connecting directly to Fastify, bypassing the proxy, to manipulate both the protocol and host as seen by the application. This issue only occurs when trustProxy is not set to true, which trusts all forwarded headers. Applications relying on request.protocol or request.host for security-sensitive operations—like HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, or host-based routing—are susceptible to attack when using a restrictive trustProxy configuration.Recommendations
fastify versions through 5.8.2 should not use a restrictive
trustProxy configuration. If a proxy is not used, do not configure trustProxy. If a proxy is used, set trustProxy to true to trust all forwarded headers, or configure a custom trust function that accurately identifies trusted proxy IPs.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fastify