CVE-2026-3635
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
23/03/2026
Last modified:
23/03/2026
Description
Summary<br />
When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: &#39;10.0.0.1&#39;, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.<br />
<br />
Affected Versions<br />
fastify
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM