CVE-2026-16732

Name of the Vulnerable Software and Affected Versions fastify versions 5.8.3 through 5.12.0

Description An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the trustProxy setting is configured with a numeric hop-count value, the system fails to properly validate the connecting address. This allows an attacker who can reach the origin directly, bypassing the front-facing proxy, to spoof forwarded request fields. This can lead to host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, as well as host-based routing and cache poisoning.

Recommendations Update to version 5.12.1. Migrate to an IP, CIDR, or custom-function trustProxy value that validates the connecting address. Ensure the origin is only reachable through the trusted proxy chain.