CVE-2026-3635 (GCVE-0-2026-3635)

Vulnerability from cvelistv5 – Published: 2026-03-23 13:53 – Updated: 2026-03-23 15:30
VLAI?
Title
Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function
Summary
Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application. Affected Versions fastify <= 5.8.2 Impact Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function. When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.
Severity ?
6.1 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE
  • CWE-348 - Use of less trusted source
Assigner
References
Impacted products
Vendor Product Version
fastify fastify Affected: 0 , ≤ 5.8.2 (semver)
Unaffected: 5.8.3 (semver)
Create a notification for this product.
Credits
LetaoZhao (TinkAnet) KaKa (climba03003) Matteo Collina Ulises Gascón
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-23T15:29:15.532885Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-23T15:30:10.526Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/fastify",
          "product": "fastify",
          "vendor": "fastify",
          "versions": [
            {
              "lessThanOrEqual": "5.8.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.8.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "LetaoZhao (TinkAnet)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "KaKa (climba03003)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Matteo Collina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ulises Gasc\u00f3n"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cb\u003eSummary\u003c/b\u003e\u003cbr\u003eWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: \u002710.0.0.1\u0027, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eAffected Versions\u003cbr\u003e\u003c/b\u003efastify \u0026lt;= 5.8.2\u003cbr\u003e\u003cbr\u003e\u003cb\u003eImpact\u003cbr\u003e\u003c/b\u003eApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\u003cbr\u003e\u003cbr\u003eWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.\u003c/p\u003e"
            }
          ],
          "value": "Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: \u002710.0.0.1\u0027, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify \u003c= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "CWE-348 Use of less trusted source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T13:53:00.386Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3635"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-3635",
    "datePublished": "2026-03-23T13:53:00.386Z",
    "dateReserved": "2026-03-06T09:16:35.081Z",
    "dateUpdated": "2026-03-23T15:30:10.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-3635",
      "date": "2026-04-20",
      "epss": "9e-05",
      "percentile": "0.00921"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-3635\",\"sourceIdentifier\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"published\":\"2026-03-23T14:16:34.720\",\"lastModified\":\"2026-04-16T17:46:58.897\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Summary\\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: \u002710.0.0.1\u0027, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\\n\\nAffected Versions\\nfastify \u003c= 5.8.2\\n\\nImpact\\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\\n\\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.\"},{\"lang\":\"es\",\"value\":\"Resumen\\nCuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva (por ejemplo, una IP espec\u00edfica como `trustProxy: \u002710.0.0.1\u0027`, una subred, un recuento de saltos o una funci\u00f3n personalizada), los *getters* `request.protocol` y `request.host` leen los encabezados `X-Forwarded-Proto` y `X-Forwarded-Host` de cualquier conexi\u00f3n, incluidas las conexiones de IPs no confiables. Esto permite a un atacante que se conecta directamente a Fastify (salt\u00e1ndose el proxy) suplantar tanto el protocolo como el *host* vistos por la aplicaci\u00f3n.\\n\\nVersiones Afectadas\\nfastify \u0026lt;= 5.8.2\\n\\nImpacto\\nLas aplicaciones que utilizan `request.protocol` o `request.host` para decisiones de seguridad (aplicaci\u00f3n de HTTPS, *flags* de cookie seguras, comprobaciones de origen CSRF, construcci\u00f3n de URL, enrutamiento basado en *host*) se ven afectadas cuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva.\\n\\nCuando `trustProxy: true` (confiar en todo), tanto el *host* como el protocolo conf\u00edan en todos los encabezados reenviados \u2014 este es el comportamiento esperado. La vulnerabilidad solo se manifiesta con configuraciones de confianza restrictivas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-348\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fastify:fastify:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"5.8.3\",\"matchCriteriaId\":\"27A424F7-D048-4767-9071-5C4D0A85FDFA\"}]}]}],\"references\":[{\"url\":\"https://cna.openjsf.org/security-advisories.html\",\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf\",\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2026-3635\",\"source\":\"ce714d77-add3-4f53-aff5-83d477b104bb\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3635\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-23T15:29:15.532885Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-23T15:29:59.578Z\"}}], \"cna\": {\"title\": \"Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"LetaoZhao (TinkAnet)\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"KaKa (climba03003)\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Matteo Collina\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Ulises Gasc\\u00f3n\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"fastify\", \"product\": \"fastify\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.8.2\"}, {\"status\": \"unaffected\", \"version\": \"5.8.3\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:npm/fastify\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2026-3635\"}, {\"url\": \"https://cna.openjsf.org/security-advisories.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Summary\\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: \u002710.0.0.1\u0027, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \\u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\\n\\nAffected Versions\\nfastify \u003c= 5.8.2\\n\\nImpact\\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\\n\\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \\u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cb\u003eSummary\u003c/b\u003e\u003cbr\u003eWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: \u002710.0.0.1\u0027, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \\u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eAffected Versions\u003cbr\u003e\u003c/b\u003efastify \u0026lt;= 5.8.2\u003cbr\u003e\u003cbr\u003e\u003cb\u003eImpact\u003cbr\u003e\u003c/b\u003eApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\u003cbr\u003e\u003cbr\u003eWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \\u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-348\", \"description\": \"CWE-348 Use of less trusted source\"}]}], \"providerMetadata\": {\"orgId\": \"ce714d77-add3-4f53-aff5-83d477b104bb\", \"shortName\": \"openjs\", \"dateUpdated\": \"2026-03-23T13:53:00.386Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-3635\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-23T15:30:10.526Z\", \"dateReserved\": \"2026-03-06T09:16:35.081Z\", \"assignerOrgId\": \"ce714d77-add3-4f53-aff5-83d477b104bb\", \"datePublished\": \"2026-03-23T13:53:00.386Z\", \"assignerShortName\": \"openjs\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.