Letaozhao

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.8.3 **Description** When `trustProxy` is configured with a restrictive trust function, such as a specific IP, a subnet, a hop count, or a custom function, the `request.protocol` and `request.host` getters read `X-Forwarded-Proto` and `X-Forwarded-Host` headers from any connection, including those from untrusted IPs. This allows an attacker connecting directly to Fastify to bypass the proxy and spoof the protocol and host seen by the application. This issue impacts applications that rely on `request.protocol` or `request.host` for security-critical decisions, including HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, and host-based routing. **Recommendations** Update fastify to version 5.8.3 or later.