CVE-2026-18174

Name of the Vulnerable Software and Affected Versions @fastify/forwarded versions prior to 3.0.2

Description When the X-Forwarded-For header contains two or more comma-separated entries, the parser fails to strip horizontal tabs, trimming only space characters. This contradicts RFC 7230, which defines optional whitespace as both spaces and tabs. Consequently, an entry padded with a tab retains the literal tab character in the resolved address string. This can lead to the evasion of security mechanisms that rely on exact string matching of the resolved client IP, such as allowlists, blocklists, per IP rate limit keys, or audit log correlation, as the corrupted string will not match the expected value.

Recommendations Update to version 3.0.2.