CVE-2026-75021

Name of the Vulnerable Software and Affected Versions fastify-cli versions 1.5.0 through 8.0.0

Description When a debug flag is used, the software starts the Node.js Inspector but ignores the explicit bind address provided by the user. Instead of binding to the intended loopback address, it binds to a broadly reachable address, exposing the debugging interface beyond the local machine. Since the Inspector protocol allows arbitrary code evaluation, a remote party with access to this interface can achieve remote code execution on the developer's machine.

Recommendations Upgrade to fastify-cli version 8.0.1.