CVE-2026-3635

Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application. Affected Versions fastify <= 5.8.2 Impact Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function. When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://cna.openjsf.org/security-advisories.html
https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf
https://www.cve.org/CVERecord?id=CVE-2026-3635

Configurations

No configuration.

History

No history.

Information

Published : 2026-03-23 14:16

Updated : 2026-03-23 14:31

NVD link : CVE-2026-3635

Mitre link : CVE-2026-3635

CVE.ORG link : CVE-2026-3635

JSON object : View

Products Affected

No product.

CWE

CWE-348

Use of Less Trusted Source

{"id": "CVE-2026-3635", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.6}]}, "published": "2026-03-23T14:16:34.720", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-3635", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-348"}]}], "descriptions": [{"lang": "en", "value": "Summary\nWhen trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection \u2014 including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.\n\nAffected Versions\nfastify <= 5.8.2\n\nImpact\nApplications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function.\n\nWhen trustProxy: true (trust everything), both host and protocol trust all forwarded headers \u2014 this is expected behavior. The vulnerability only manifests with restrictive trust configurations."}, {"lang": "es", "value": "Resumen\nCuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva (por ejemplo, una IP espec\u00edfica como `trustProxy: '10.0.0.1'`, una subred, un recuento de saltos o una funci\u00f3n personalizada), los *getters* `request.protocol` y `request.host` leen los encabezados `X-Forwarded-Proto` y `X-Forwarded-Host` de cualquier conexi\u00f3n, incluidas las conexiones de IPs no confiables. Esto permite a un atacante que se conecta directamente a Fastify (salt\u00e1ndose el proxy) suplantar tanto el protocolo como el *host* vistos por la aplicaci\u00f3n.\n\nVersiones Afectadas\nfastify <= 5.8.2\n\nImpacto\nLas aplicaciones que utilizan `request.protocol` o `request.host` para decisiones de seguridad (aplicaci\u00f3n de HTTPS, *flags* de cookie seguras, comprobaciones de origen CSRF, construcci\u00f3n de URL, enrutamiento basado en *host*) se ven afectadas cuando `trustProxy` se configura con una funci\u00f3n de confianza restrictiva.\n\nCuando `trustProxy: true` (confiar en todo), tanto el *host* como el protocolo conf\u00edan en todos los encabezados reenviados \u2014 este es el comportamiento esperado. La vulnerabilidad solo se manifiesta con configuraciones de confianza restrictivas."}], "lastModified": "2026-03-23T14:31:37.267", "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}