CVE-2026-3635

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.8.3

Description When trustProxy is configured with a restrictive trust function, such as a specific IP, a subnet, a hop count, or a custom function, the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection, including those from untrusted IPs. This allows an attacker connecting directly to Fastify to bypass the proxy and spoof the protocol and host seen by the application. This issue impacts applications that rely on request.protocol or request.host for security-critical decisions, including HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, and host-based routing.

Recommendations Update fastify to version 5.8.3 or later.