CVE-2026-3635

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3635
Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application. Affected Versions fastify <= 5.8.2 Impact Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function. When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cna.openjsf.org/security-advisories.html Third Party Advisory
https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-3635 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*
History

16 Apr 2026, 17:46

Type Values Removed Values Added
Summary
  • (es) Resumen Cuando `trustProxy` se configura con una función de confianza restrictiva (por ejemplo, una IP específica como `trustProxy: '10.0.0.1'`, una subred, un recuento de saltos o una función personalizada), los *getters* `request.protocol` y `request.host` leen los encabezados `X-Forwarded-Proto` y `X-Forwarded-Host` de cualquier conexión, incluidas las conexiones de IPs no confiables. Esto permite a un atacante que se conecta directamente a Fastify (saltándose el proxy) suplantar tanto el protocolo como el *host* vistos por la aplicación. Versiones Afectadas fastify &lt;= 5.8.2 Impacto Las aplicaciones que utilizan `request.protocol` o `request.host` para decisiones de seguridad (aplicación de HTTPS, *flags* de cookie seguras, comprobaciones de origen CSRF, construcción de URL, enrutamiento basado en *host*) se ven afectadas cuando `trustProxy` se configura con una función de confianza restrictiva. Cuando `trustProxy: true` (confiar en todo), tanto el *host* como el protocolo confían en todos los encabezados reenviados — este es el comportamiento esperado. La vulnerabilidad solo se manifiesta con configuraciones de confianza restrictivas.
References () https://cna.openjsf.org/security-advisories.html - () https://cna.openjsf.org/security-advisories.html - Third Party Advisory
References () https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf - () https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf - Vendor Advisory
References () https://www.cve.org/CVERecord?id=CVE-2026-3635 - () https://www.cve.org/CVERecord?id=CVE-2026-3635 - Third Party Advisory
First Time Fastify fastify
Fastify
CPE cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*

23 Mar 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 14:16

Updated : 2026-04-16 17:46

NVD link : CVE-2026-3635

Mitre link : CVE-2026-3635

CVE.ORG link : CVE-2026-3635

JSON object : View

Products Affected

fastify

  • fastify
CWE
CWE-348

Use of Less Trusted Source